Forum Discussion
Can any query be saved as a function ?
I have written a query that is a bit involved, it is multi-line and it contains a union and a call to lookup. It works well as a query, but if I save it as a function and then try to run that, I get ...
If you think this is some kind of a bug better log official case to MSFT. Seems the combination of using let with workspace() operator is causing the error. I for sure haven't seen this behavior documented.
I meant I have successfully created a function that uses a different workspace and works correctly, both as a query and as a custom function, this one in particular :
workspace("something").Event_CL | distinct Bla | extend stn=substring(Bla, 1, 5);
But, since you encountered an error, I have tried your suggestion and indeed the complete query works if I remove the call to workspace. It seems the combination of workspace and lookup break something, which is interesting.
Not quite sure yet what to do with the knowledge though.
If you think this is some kind of a bug better log official case to MSFT. Seems the combination of using let with workspace() operator is causing the error. I for sure haven't seen this behavior documented.
I have opened a support case for this behavior, and the Kusto team acknowledged this is a bug. I was told it should be fixed around the 6th of March.