Forum Discussion

subrahmanyam kommireddy's avatar
subrahmanyam kommireddy
Copper Contributor
Sep 20, 2018

How to pass dynamic data to the "Where Condtion"

Hi,

Can some one help me how to pass the variable data dynamically in where condition for log analytics query . below query is not executing , it is telling that "Syntax Error"

 

Example :

let ID = customatable | top 1 by TimeGenerated | summarize by id

search Column = "ABC" | where id == ID | sort by timmegenerated desc

  • Hi Patrick ,

    Sorry for the late reply.. I got other solution... 

    And yes It is working as well, appreciate your help.. thank you.

  • Thank you for response..

    Sorry for typo(mistakenly keyed), But I have tried exactly below(semicolon after let statement and correct spelling for TimeGenerated) ,

    erro is "'where' operator: Failed to resolve column or scalar expression named 'id' 

     

    let ID = customatable | top 1 by TimeGenerated | summarize by id;

    search Columname = "ABC" | where id == ID | sort by TimeGenerated desc

    • Patrick Naughton's avatar
      Patrick Naughton
      Brass Contributor
      let ID = toscalar(customtable_CL | top 1 by TimeGenerated desc | project id);
      customtable_CL | where  Columname == "ABC" and id == ID | order by TimeGenerated desc
      • subrahmanyam kommireddy's avatar
        subrahmanyam kommireddy
        Copper Contributor

        Hi Patrick ,

        Sorry for the late reply.. I got other solution... 

        And yes It is working as well, appreciate your help.. thank you.

  • I see a couple things that could cause the error.  There is no semicolon at the end of the let statement and TimeGenerated on the second line is incorrect.  It looks like you are referencing custom logs so I can't run it in the demo site to better test.  If you are not already, try running the query in the new "Logs" Blade in the Log Analytics portal.  Analytics has auto-complete and error indication that may help weed out syntax errors.

     

Resources