Forum Discussion
if statment in a KQL query?
Where is the drop down list, is it from a Workbook parameter?
There is IIF() https://docs.microsoft.com/en-us/azure/data-explorer/kusto/query/iiffunction
Yes my parameter comes from a dropdownlist, i have json values for the dropdownlist
The parameter i will use is called {Honeytoken:label}
What i want to achieve is that based on the dropdownlist value there should be another query be executed.
for example u have this query :
- A parameter is text, so use " " e.g.
| extend test = iff("{Honeytoken:label}" == "File","Yes its a file","No its not")| extend test = iff("{Honeytoken:label}" == "File","Yes its a file","No its not")
this works but instead of "yes its a file" i would rather return a query and not a string.
each dropdownlist value need to return a different query
I've done this another way. I have a parameter called KQLquery, which has the KQL in a JSON drop-down.
Then all you need to do is "Add a query" and use the parameter name {KQLquery} in this case.