Forum Discussion
Kusto user-defined function for common actions
I'm looking to leverage common functions across a number of queries so we can update in one place rather than in every analytic. First question, would it be possible to have a function that just ...
pemontto the below query works without any issue for me.
let NetworkData = datatable (Address:string )
[
"127.0.0.1"
];
let is_primary = (ip:string) {
iif(dynamic([
"127.0.0.1",
"127.0.0.2",
"127.0.0.3"
]) contains ip, true, false)
};
NetworkData
| where is_primary(Address) == "true"
Did you try saving the function under KQL queries, then invoking it remotely from a KQL editor window ?
In my case, if all code is together, like in the snippet you shared, it works. IF i save the func and invoke it, it won't work.
- Looks like the only way to create a parameterized function is to use resource templates.
https://docs.microsoft.com/en-us/azure/azure-monitor/samples/resource-manager-log-queries#parameterized-function- I didn't try it but if you look at the template on the page, it uses log analytic workspaces. Azure monitor is based on log analytics as well.
