Forum Discussion

abon13's avatar
abon13
Brass Contributor
Dec 07, 2022

column_if_exists throws error "The expression must be constant"

Hi,

 

I have the below query in which I want to check if the UserAgent column exists, however I am unable to complete column_if_exists as it underlines in red "UserAgent". Hovering my mouse over it shows  error message  "The expression must be constant. UserAgent:dynamic"

 

How do I resolve this ?

 

AuditLogs
| where TimeGenerated >= ago(7d)
| where InitiatedBy has 'a.b.c.d'
| mv-apply AdditionalDetails on ( where AdditionalDetails.key == "User-Agent"| extend UserAgent=AdditionalDetails.value)
| extend UserAgent_2=column_ifexists(UserAgent, " ") 

 

 

Thank you !!

  • Clive_Watson's avatar
    Clive_Watson
    Bronze Contributor
    Trying adding quotes

    | extend UserAgent_2=column_ifexists("UserAgent", " ")
    • abon13's avatar
      abon13
      Brass Contributor
      This did not work as expected. Instead I used iff and it works

      | extend UserAgent= iif( AdditionalDetails.key == "User-Agent", UserAgent=AdditionalDetails.value, " ")

Resources