Forum Discussion
if statment in a KQL query?
Hello, I was wondering if its possible to write an if statement in a kql query for example i have a dropdownlist, and based on the value i want to execute a query Anyone know how this is don...
A parameter is text, so use " " e.g.
| extend test = iff("{Honeytoken:label}" == "File","Yes its a file","No its not")
| extend test = iff("{Honeytoken:label}" == "File","Yes its a file","No its not")
| extend test = iff("{Honeytoken:label}" == "File","Yes its a file","No its not")
this works but instead of "yes its a file" i would rather return a query and not a string.
each dropdownlist value need to return a different query
I've done this another way. I have a parameter called KQLquery, which has the KQL in a JSON drop-down.
Then all you need to do is "Add a query" and use the parameter name {KQLquery} in this case.