SOLVED
Home

Escape/Ignore funcitons in Log Analytics

%3CLINGO-SUB%20id%3D%22lingo-sub-308361%22%20slang%3D%22en-US%22%3EEscape%2FIgnore%20funcitons%20in%20Log%20Analytics%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-308361%22%20slang%3D%22en-US%22%3E%3CP%3EHi%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI'm%20trying%20to%20write%20a%20query%20that%20outputs%20a%20column%20named%20%22time%22%20(Notice%20the%20lower%20case%20't').%3CBR%20%2F%3EWhen%20doing%20so%2C%20for%20instance%20with%20the%20%22extend%22%20function%2C%20it%20presents%20me%20with%20a%20syntax%20error%20message%20due%20to%20%22time%22%20being%20a%20function%20in%20Log%20Analytics%20already.%20That%20means%20I'm%20forced%20to%20name%20the%20column%20%22Time%22%20(with%20an%20upper%20case%20'T')%20which%20does%20not%20work%20with%20case%20sensitive%20software%20like%20Grafana%2C%20which%20does%20not%20recognize%20a%20time%20column%20without%20the%20column%20being%20named%20time%20with%20a%20lower%20case%20't'.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSTRONG%3EExample%3A%3C%2FSTRONG%3E%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20408px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F64563i9C13918323DC81A0%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%222019-01-03%2011_05_13-Clipboard.png%22%20title%3D%222019-01-03%2011_05_13-Clipboard.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAny%20suggestions%20would%20be%20appreciated.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-308361%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%20Log%20Analytics%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EQuery%20Language%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-308795%22%20slang%3D%22en-US%22%3ERe%3A%20Escape%2FIgnore%20funcitons%20in%20Log%20Analytics%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-308795%22%20slang%3D%22en-US%22%3E%3CP%3EPerfect!%20Just%20what%20I%20was%20looking%20for.%20Just%20tested%20and%20I%20now%20see%20the%20expected%20results.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%20a%20lot%20%3A)%3C%2Fimg%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-308446%22%20slang%3D%22en-US%22%3ERe%3A%20Escape%2FIgnore%20funcitons%20in%20Log%20Analytics%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-308446%22%20slang%3D%22en-US%22%3EHi%2C%3CBR%20%2F%3E%3CBR%20%2F%3E%22time%22%20is%20a%20reserved%20word%20in%20our%20query%20language%20so%20it%20shall%20be%20expressed%20differently%3A%3CBR%20%2F%3E%7C%20extend%20%5B'time'%5D%20%3D%20TimeGenerated%3CBR%20%2F%3E%3CBR%20%2F%3EThanks%2C%3CBR%20%2F%3EMeir%3C%2FLINGO-BODY%3E
Ali Kristoffer Njie
Occasional Contributor

Hi,

 

I'm trying to write a query that outputs a column named "time" (Notice the lower case 't').
When doing so, for instance with the "extend" function, it presents me with a syntax error message due to "time" being a function in Log Analytics already. That means I'm forced to name the column "Time" (with an upper case 'T') which does not work with case sensitive software like Grafana, which does not recognize a time column without the column being named time with a lower case 't'.

 

Example:

2019-01-03 11_05_13-Clipboard.png

 

Any suggestions would be appreciated.

2 Replies
Solution
Hi,

"time" is a reserved word in our query language so it shall be expressed differently:
| extend ['time'] = TimeGenerated

Thanks,
Meir

Perfect! Just what I was looking for. Just tested and I now see the expected results.

 

Thanks a lot :)

Related Conversations
Tabs and Dark Mode
cjc2112 in Discussions on
48 Replies
Extentions Synchronization
Deleted in Discussions on
3 Replies
Stable version of Edge insider browser
HotCakeX in Discussions on
35 Replies
How to Prevent Teams from Auto-Launch
chenrylee in Microsoft Teams on
30 Replies
flashing a white screen while open new tab
Deleted in Discussions on
14 Replies
Security Community Webinars
Valon_Kolica in Security, Privacy & Compliance on
13 Replies