SOLVED

Custom field for Timegenerated

%3CLINGO-SUB%20id%3D%22lingo-sub-1323408%22%20slang%3D%22en-US%22%3ECustom%20field%20for%20Timegenerated%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1323408%22%20slang%3D%22en-US%22%3E%3CP%3EWe%20are%20using%20the%20below%20query%20to%20get%20time%20details%20%2C%20it%20is%20working%20fine%20in%20workbooks%20but%20it%20is%20not%20working%20in%20logs%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CDIV%3E%0A%3CDIV%3E%3CSPAN%3Elet%20data%20%3D%20ADFTriggerRun%3C%2FSPAN%3E%3C%2FDIV%3E%0A%3CDIV%3E%3CSPAN%3E%7C%20%3C%2FSPAN%3E%3CSPAN%3Ewhere%3C%2FSPAN%3E%3CSPAN%3E%20TimeGenerated%20%3C%2FSPAN%3E%3CSPAN%3E%7B%3C%2FSPAN%3E%3CSPAN%3ETimeRange%3C%2FSPAN%3E%3CSPAN%3E%7D%3C%2FSPAN%3E%3C%2FDIV%3E%0A%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%0A%3CDIV%3E%0A%3CDIV%20class%3D%22header-block%22%3E%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20class%3D%22ai-tip-tests-error-message%20ng-binding%22%20aria-live%3D%22assertive%22%3ESYNTAX%20ERROR%3C%2FSPAN%3E%3C%2FDIV%3E%0A%3CDIV%20class%3D%22details-block%20ng-binding%22%3EQuery%20could%20not%20be%20parsed%20at%20'%7B'%20on%20line%20%5B2%2C22%5D%20Token%3A%20%7B%20Line%3A%202%20Position%3A%2022%3C%2FDIV%3E%0A%3CDIV%20class%3D%22details-block%20ng-binding%22%3E%26nbsp%3B%3C%2FDIV%3E%0A%3CDIV%20class%3D%22details-block%20ng-binding%22%3E%3CSPAN%3ERequest%20id%3A%201481ff60-9ae7-428d-9d22-426ecf49a693%3C%2FSPAN%3E%3C%2FDIV%3E%0A%3C%2FDIV%3E%0A%3C%2FDIV%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1323408%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%20Log%20Analytics%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1323660%22%20slang%3D%22en-US%22%3ERe%3A%20Custom%20field%20for%20Timegenerated%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1323660%22%20slang%3D%22en-US%22%3EThis%20will%20work%20in%20logs.%3CBR%20%2F%3E%3CBR%20%2F%3E%7C%20where%20TimeGenerated%20%26gt%3B%20ago(1d)%3CBR%20%2F%3E%3CBR%20%2F%3E%7BTimerange%7D%20is%20unique%20to%20a%20Workbook%20and%20takes%20the%20Parameter%20from%20a%20drop%20down%2C%20replacing%20the%20selected%20value%20with%20something%20like%20%26gt%3B%20ago(7d).%20You%20can't%20reuse%20these%20parameters%20in%20a%20normal%20query%20as%20the%20drop%20down%20control%20doesn't%20exist%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1323677%22%20slang%3D%22en-US%22%3ERe%3A%20Custom%20field%20for%20Timegenerated%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1323677%22%20slang%3D%22en-US%22%3Ethanks%20Clive%2C%3CBR%20%2F%3EIt%20is%20working%20fine%20now%3C%2FLINGO-BODY%3E
Highlighted
Microsoft

We are using the below query to get time details , it is working fine in workbooks but it is not working in logs 

 

let data = ADFTriggerRun
| where TimeGenerated {TimeRange}
 
 SYNTAX ERROR
Query could not be parsed at '{' on line [2,22] Token: { Line: 2 Position: 22
 
Request id: 1481ff60-9ae7-428d-9d22-426ecf49a693
2 Replies
Highlighted
Solution
This will work in logs.

| where TimeGenerated > ago(1d)

{Timerange} is unique to a Workbook and takes the Parameter from a drop down, replacing the selected value with something like > ago(7d). You can't reuse these parameters in a normal query as the drop down control doesn't exist
Highlighted
thanks Clive,
It is working fine now