Getting error 'unknown function'



I looked into this doc to create function.


I created function something like this:

let BIA = (timeframe:string="90d")
| where Category == "AzureBackupReport" and OperationName == "BackupItemAssociation"
| project BackupItemUniqueId_s , BackupItemSourceSize_s , TimeGenerated 
| where TimeGenerated >= ago(90d)  

Then saved the function under a category. It appears in my right pane when I clicked query explorer.

However when I try to call this function (by either name or alias), it displays unknown function.

Let's say function name BIA_func and alias is BIA.

when I call BIA_func() or  BIA(), it says unknown function.

But When I clicked the function, then it displayed the function code. then when i call the function, it is able to display the function code.


What am I missing here? My objective is to create saved queries and then call the queries standalone by name or alias.



7 Replies


I think the correct way is to have this query:

| where Category == "AzureBackupReport" and OperationName == "BackupItemAssociation"
| project BackupItemUniqueId_s , BackupItemSourceSize_s , TimeGenerated 
| where TimeGenerated >= ago(90d)  

Save this query as function. For example you can name the function BIA.

After that in Logs blade you just execute BIA just like it is table.



Hi @Stanislav Zhelyazkov 


I have done exactly the same. But getting error - Body of the callable expression cannot be empty.

I tried both BIA and BIA().Please look at the attached image.

But when I click the saved function, then it displays the function code.






I am pretty sure that you are not doing the same steps. Here are some detailed steps.

You create the function like this:


Do not use let operator. When executed the query should produce results (in my case I do not have the data but in your case you should). and save it as it is.

After that you can execute the function. Notice that intellisense now even recognize it.


Once executed the same results will be produced. For me the same error is produced as I do not have that data.


Today when I checked the function in the left pane, it was showing those functions created yesterday.

I also refreshed yesterday but it was not showing the functions.


It looks like there is some delay in showing up functions in the left pane. Even the intellisense was not suggesting the function created yesterday. It is suggesting the function today.



Must be something to your workspace at that time. There is no delay usually. Functions are created right away and to see them in the UI sometimes you will need to refresh the portal but they can be used right away.

It looks like workspace specific issue. I created another workspace and it was also having delay. It did not show up functions immediately. However, when I create functions in one of our old workspace, I noticed functions appear immediately in the left pane after refresh. Not sure if it is bug or some configuration related to that workspace.

@Stanislav Zhelyazkov , On the similar line, is it possible to create saved function with arguments? I basically would like to create function with time range arguments, so that I can have single function  to return results for different time period.

I do not think that is possible. If you going to provide input the user of the function have to enter some information anyway so why do you use function at all. You might be better with just saved query. Functions to me are more line predefined scope.

Related Conversations
flashing a white screen while open new tab
cntvertex in Discussions on
13 Replies
Stable version of Edge insider browser
HotCakeX in Discussions on
35 Replies
Tabs and Dark Mode
cjc2112 in Discussions on
22 Replies
How to Prevent Teams from Auto-Launch
chenrylee in Microsoft Teams on
28 Replies