Forum Discussion
abon13
Dec 07, 2022Brass Contributor
column_if_exists throws error "The expression must be constant"
Hi,
I have the below query in which I want to check if the UserAgent column exists, however I am unable to complete column_if_exists as it underlines in red "UserAgent". Hovering my mouse over it shows error message "The expression must be constant. UserAgent:dynamic"
How do I resolve this ?
AuditLogs
| where TimeGenerated >= ago(7d)
| where InitiatedBy has 'a.b.c.d'
| mv-apply AdditionalDetails on ( where AdditionalDetails.key == "User-Agent"| extend UserAgent=AdditionalDetails.value)
| extend UserAgent_2=column_ifexists(UserAgent, " ")
Thank you !!
- Clive_WatsonBronze ContributorTrying adding quotes
| extend UserAgent_2=column_ifexists("UserAgent", " ")- abon13Brass ContributorThis did not work as expected. Instead I used iff and it works
| extend UserAgent= iif( AdditionalDetails.key == "User-Agent", UserAgent=AdditionalDetails.value, " ")