Forum Discussion

Copper Contributor

Aug 18, 2022

Solved

Alternative to using 'top' operator with a calculated variable

I was wondering of anyone knows a workaround to using the 'top' operator along with a variable calculated at runtime. As can be seen by running the sample query below, Sentinel doesn't seem to like a...

Aug 18, 2022

Princely Try this

let x=5; let y =2; 
SecurityAlert 
| summarize count() by AlertName 
| extend a = x-y 
| top toint(x-y) by count_ asc

GBushey

Former Employee

Aug 18, 2022

Princely Try this

let x=5; let y =2; 
SecurityAlert 
| summarize count() by AlertName 
| extend a = x-y 
| top toint(x-y) by count_ asc

Princely
Copper Contributor
Aug 18, 2022
Thanks! That works.