Forum Discussion
KQL: setting query time leads to problem in watchlist column projecting
Hello to the community! I have stumbled upon a very strange issue when using watchlists. I have a watchlist with 2 columns (userPrincipalName,allowedActivity) that I am then using to whitelis...
Hola !
The problem isn’t your watchlist — it’s the set command.
When you use set querynow = before loading your watchlist, KQL’s “brain” (parser) gets confused. The GetWatchlist() function is actually a little macro behind the scenes, and with set in front of it, KQL messes up and forgets that your watchlist has a column called userPrincipalName. That’s why you get the “Failed to resolve” error.
If you remove set or move it after your watchlist load, it works fine. Even better, use let instead of set for your date variable
Think of set as “global, sometimes messy” and let as “local, safe.”
In short — switch set to let, or move it down in your query, and the error will go away.
gracias !!