SOLVED
Home

User defined functon

%3CLINGO-SUB%20id%3D%22lingo-sub-743982%22%20slang%3D%22en-US%22%3EUser%20defined%20functon%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-743982%22%20slang%3D%22en-US%22%3E%3CP%3EWorking%20with%20Log%20Analytics%20I%20am%20trying%20to%20convert%20a%20query%20to%20a%20user%20defined%20function.%20I%20have%20never%20done%20that%20before%20and%20examples%20of%20user%20defined%20functions%20on%20the%20web%20are%20pretty%20rare.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20am%20getting%20a%20syntax%20error%20in%20the%20parameter%20list%20(I%20think)%20but%20do%20not%20know%20why.%20(The%20diagnostics%20are%20not%20too%20helpful.)%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHere%20is%20the%20function%20and%20the%20calling%20requests%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%2F%2F%20Determine%20avg%20churn%20rate%20on%20selected%20disk%20since%20specified%20start%20date%20and%20group%20by%20time%20generated%20in%20specified%20units%3CBR%20%2F%3E%2F%2F%20Render%20in%20selected%20format%20later.%20How%20to%20specify%20in%20function%20(what%20type%3F)%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Elet%20GetDiskChurn%20%3D%20(servername%3Astring%2C%20agosince%3Atimespan%2C%20intervals%3Atimespan%2C%20testdisk%3Astring)%20%7B%3CBR%20%2F%3EPerf%3CBR%20%2F%3E%7C%20where%20Computer%20%3D%3D%20servername%3CBR%20%2F%3E%7C%20where%20TimeGenerated%20%26gt%3B%20ago(agosince)%3CBR%20%2F%3E%7C%20where%20InstanceName%20%3D%3D%20testdisk%3CBR%20%2F%3E%7C%20where%20CounterName%20%3D%3D%20%E2%80%9CDisk%20Write%20Bytes%2Fsec%E2%80%9D%3CBR%20%2F%3E%7C%20summarize%20avg(CounterValue)%20by%20CounterPath%2C%20bin(TimeGenerated%2C%20intervals)%3CBR%20%2F%3E%2F%2F%20convert%20into%20MBps%3CBR%20%2F%3E%7C%20extend%20inMBs%20%3D%20avg_CounterValue%20%2F%201000000.0%3CBR%20%2F%3E%2F%2F%20round(inMBs%2C%201)%3CBR%20%2F%3E%7C%20project%20CounterPath%2C%20TimeGenerated%2C%20inMBs%3CBR%20%2F%3E%2F%2F%20%7C%20render%20renderformat%20later%20type%3F%3CBR%20%2F%3E%7D%3CBR%20%2F%3EGetDiskChurn%20(%E2%80%9Csqlserver.myco.com%22%2C%20agosince%20%3D%205h%2C%20intervals%20%3D%201m%2C%20testdisk%20%3D%20%22F%3A%22)%3CBR%20%2F%3E%2F%2F%20Is%20the%20error%20agosince%20timespan%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EGetDiskChurn%20(%E2%80%9Csqlserver.myco.com%E2%80%9D%2C%20agosince%20%3D%201d%2C%20intervals%20%3D%201h%2C%20testdisk%20%3D%20%22F%3A%22%2C%20)%3CBR%20%2F%3EGetDiskChurn%20(%E2%80%9Csqlserver.myco.com%E2%80%9D%2C%20agosince%20%3D%2016h%2C%20intervals%20%3D%201m%2C%20testdisk%20%3D%20%22F%3A%22)%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%3CBR%20%2F%3EBill%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-743982%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%20Log%20Analytics%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-743984%22%20slang%3D%22en-US%22%3ERe%3A%20User%20defined%20functon%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-743984%22%20slang%3D%22en-US%22%3EAlso%20forgot%20the%20%3B%20at%20the%20end%20of%20the%20let%20%7B%7D%3B%3CBR%20%2F%3EStill%20does%20not%20work.%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-743986%22%20slang%3D%22en-US%22%3ERe%3A%20User%20defined%20functon%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-743986%22%20slang%3D%22en-US%22%3EI%20tired%20this%20with%20the%20%3B%20at%20the%20end%20of%20the%20let%20but%20it%20still%20did%20not%20work.%3CBR%20%2F%3EBill%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-744132%22%20slang%3D%22en-US%22%3ERe%3A%20User%20defined%20functon%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-744132%22%20slang%3D%22en-US%22%3E%3CP%3EHIi%20%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F323676%22%20target%3D%22_blank%22%3E%40BillZack1234%3C%2FA%3E%2C%3C%2FP%3E%0A%3CP%3EYes%20there%20should%20be%20%3B%20at%20the%20end%20of%20the%20function%20and%20you%20fixed%20that.%20I%20think%20also%20the%20function%20should%20container%20lowercase%20characters%20only.%20I%20couldn't%20find%20information%20where%20this%20is%20documented.%20After%20you%20fix%20the%20name%20it%20should%20work.%20I've%20tried%20it%20in%20the%20demo%20environment%20and%20it%20works.%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20948px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F122667i54BD0F5DDBC94928%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22Capture.PNG%22%20title%3D%22Capture.PNG%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-745872%22%20slang%3D%22en-US%22%3ERe%3A%20User%20defined%20functon%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-745872%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F9172%22%20target%3D%22_blank%22%3E%40Stanislav%20Zhelyazkov%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%20great%20help.%3C%2FP%3E%3CP%3EI%20also%20had%20some%20issues%20with%20quotes.%3C%2FP%3E%3CP%3EThe%20documentation%20and%20the%20diagnostics%20could%20use%20some%20improvement%20where%20User%20Defined%20Functions%20are%20concerned.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EBill%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E
BillZack1234
Occasional Contributor

Working with Log Analytics I am trying to convert a query to a user defined function. I have never done that before and examples of user defined functions on the web are pretty rare.

 

I am getting a syntax error in the parameter list (I think) but do not know why. (The diagnostics are not too helpful.)

 

Here is the function and the calling requests:

 

// Determine avg churn rate on selected disk since specified start date and group by time generated in specified units
// Render in selected format later. How to specify in function (what type?)

 

let GetDiskChurn = (servername:string, agosince:timespan, intervals:timespan, testdisk:string) {
Perf
| where Computer == servername
| where TimeGenerated > ago(agosince)
| where InstanceName == testdisk
| where CounterName == “Disk Write Bytes/sec”
| summarize avg(CounterValue) by CounterPath, bin(TimeGenerated, intervals)
// convert into MBps
| extend inMBs = avg_CounterValue / 1000000.0
// round(inMBs, 1)
| project CounterPath, TimeGenerated, inMBs
// | render renderformat later type?
}
GetDiskChurn (“sqlserver.myco.com", agosince = 5h, intervals = 1m, testdisk = "F:")
// Is the error agosince timespan?

 

GetDiskChurn (“sqlserver.myco.com”, agosince = 1d, intervals = 1h, testdisk = "F:", )
GetDiskChurn (“sqlserver.myco.com”, agosince = 16h, intervals = 1m, testdisk = "F:")

 

Thanks
Bill

4 Replies
Also forgot the ; at the end of the let {};
Still does not work.
I tired this with the ; at the end of the let but it still did not work.
Bill
Solution

HIi @BillZack1234 ,

Yes there should be ; at the end of the function and you fixed that. I think also the function should container lowercase characters only. I couldn't find information where this is documented. After you fix the name it should work. I've tried it in the demo environment and it works.

Capture.PNG

@Stanislav Zhelyazkov 

Thanks great help.

I also had some issues with quotes.

The documentation and the diagnostics could use some improvement where User Defined Functions are concerned.

 

Bill