Dec 21 2017
11:17 AM
- last edited on
Apr 07 2022
04:50 PM
by
TechCommunityAP
Dec 21 2017
11:17 AM
- last edited on
Apr 07 2022
04:50 PM
by
TechCommunityAP
I want to perform a subselect on a related set of data. That subdata needs to be filtered using data from the main query:
customEvents
| extend envId = tostring(customDimensions.EnvironmentId)
| extend organisation = tostring(customDimensions.OrganisationName)
| extend version = tostring(customDimensions.Version)
| extend app = tostring(customDimensions.Appname)
| where customDimensions.EventName contains "ApiSessionStartStart"
| extend dbInfo = toscalar(
customEvents
| extend dbInfo = tostring(customDimensions.dbInfo)
| extend serverEnvId = tostring(customDimensions.EnvironmentId)
| where customDimensions.EventName == "ServiceSessionStart" or customDimensions.EventName == "ServiceSessionContinuation"
| where serverEnvId = envId // This gives and error
| project dbInfo
| take 1)
| order by timestamp desc
| project timestamp, customDimensions.OrganisationName, customDimensions.Version, customDimensions.onBehalfOf, customDimensions.userId, customDimensions.Appname, customDimensions.apiKey, customDimensions.remoteIp, session_Id , dbInfo, envId
The above query results in an error:
> Failed to resolve entity 'envId'
How can I filter the data in the subselect based on the field `envId` in the main query?
Dec 26 2017 11:51 AM - edited Dec 26 2017 11:52 AM
It seems to me like you're actually doing a join, so this might be easier:
customEvents | extend envId = tostring(customDimensions.EnvironmentId) | extend organisation = tostring(customDimensions.OrganisationName) | extend version = tostring(customDimensions.Version) | extend app = tostring(customDimensions.Appname) | where customDimensions.EventName contains "ApiSessionStartStart" | join ( customEvents | extend dbInfo = tostring(customDimensions.dbInfo) | extend envId = tostring(customDimensions.EnvironmentId) | where customDimensions.EventName == "ServiceSessionStart" or customDimensions.EventName == "ServiceSessionContinuation" | take 1) on envId // This gives and error | order by timestamp desc | project timestamp, customDimensions.OrganisationName, customDimensions.Version, customDimensions.onBehalfOf, customDimensions.userId, customDimensions.Appname, customDimensions.apiKey, customDimensions.remoteIp, session_Id , dbInfo, envId
I admit I might have misunderstood the meaning of your query, but joined just seemed to pop.