Forum Discussion

acabrales666's avatar
acabrales666
Copper Contributor
May 18, 2022
Solved

KQL query not working

Hi everyone, I'm not a kusto expert so bare with me. I'm trying to replace a text to another text... The one in bold is what I'm tryng to use but is not working.   Basically the log doesn't make a ...
KQL
kusto
Reports
workbooks
  • Clive_Watson's avatar
    Clive_Watson
    May 19, 2022

    acabrales666 

    Would this work, just use ?

    datatable (ThreatId:string) ["A value","9999","somthing else"]
| extend ThreatId = iif(ThreatId == "9999","URL filtering log",ThreatId)

     

mikhailf's avatar
mikhailf
Steel Contributor
May 18, 2022

Hello acabrales666,

 

Are you trying to replace "9999" in ThreatId column? 

 

    • Clive_Watson's avatar
      Clive_Watson
      Bronze Contributor
      May 19, 2022

      acabrales666 

      Would this work, just use ?

      datatable (ThreatId:string) ["A value","9999","somthing else"]
| extend ThreatId = iif(ThreatId == "9999","URL filtering log",ThreatId)

       

      • Alex_Wizard's avatar
        Alex_Wizard
        Copper Contributor
        Mar 29, 2026

        Hi Clive_Watson!

        I'm having a problem related to KQL and would really appreciate your advice.

        dnsresources

         

        | where id contains '/dnsZones/a.com'

         

        | project name, id, properties

         

        | order by name asc

         

        I want to improve performance. I've been using dnsresource. I've created a new record set, but when I query it, It doesn't return results immediately like using the kql dnszone resource query. It takes a very long time. Does anyone know how to fix this? Please share your solution with me. Thanks !!!!