SOLVED
Home

Escape/Ignore funcitons in Log Analytics

%3CLINGO-SUB%20id%3D%22lingo-sub-308361%22%20slang%3D%22en-US%22%3EEscape%2FIgnore%20funcitons%20in%20Log%20Analytics%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-308361%22%20slang%3D%22en-US%22%3E%3CP%3EHi%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI'm%20trying%20to%20write%20a%20query%20that%20outputs%20a%20column%20named%20%22time%22%20(Notice%20the%20lower%20case%20't').%3CBR%20%2F%3EWhen%20doing%20so%2C%20for%20instance%20with%20the%20%22extend%22%20function%2C%20it%20presents%20me%20with%20a%20syntax%20error%20message%20due%20to%20%22time%22%20being%20a%20function%20in%20Log%20Analytics%20already.%20That%20means%20I'm%20forced%20to%20name%20the%20column%20%22Time%22%20(with%20an%20upper%20case%20'T')%20which%20does%20not%20work%20with%20case%20sensitive%20software%20like%20Grafana%2C%20which%20does%20not%20recognize%20a%20time%20column%20without%20the%20column%20being%20named%20time%20with%20a%20lower%20case%20't'.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSTRONG%3EExample%3A%3C%2FSTRONG%3E%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20408px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F64563i9C13918323DC81A0%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%222019-01-03%2011_05_13-Clipboard.png%22%20title%3D%222019-01-03%2011_05_13-Clipboard.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAny%20suggestions%20would%20be%20appreciated.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-308361%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%20Log%20Analytics%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EQuery%20Language%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-308795%22%20slang%3D%22en-US%22%3ERe%3A%20Escape%2FIgnore%20funcitons%20in%20Log%20Analytics%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-308795%22%20slang%3D%22en-US%22%3E%3CP%3EPerfect!%20Just%20what%20I%20was%20looking%20for.%20Just%20tested%20and%20I%20now%20see%20the%20expected%20results.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%20a%20lot%20%3A)%3C%2Fimg%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-308446%22%20slang%3D%22en-US%22%3ERe%3A%20Escape%2FIgnore%20funcitons%20in%20Log%20Analytics%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-308446%22%20slang%3D%22en-US%22%3EHi%2C%3CBR%20%2F%3E%3CBR%20%2F%3E%22time%22%20is%20a%20reserved%20word%20in%20our%20query%20language%20so%20it%20shall%20be%20expressed%20differently%3A%3CBR%20%2F%3E%7C%20extend%20%5B'time'%5D%20%3D%20TimeGenerated%3CBR%20%2F%3E%3CBR%20%2F%3EThanks%2C%3CBR%20%2F%3EMeir%3C%2FLINGO-BODY%3E
Highlighted
Occasional Contributor

Hi,

 

I'm trying to write a query that outputs a column named "time" (Notice the lower case 't').
When doing so, for instance with the "extend" function, it presents me with a syntax error message due to "time" being a function in Log Analytics already. That means I'm forced to name the column "Time" (with an upper case 'T') which does not work with case sensitive software like Grafana, which does not recognize a time column without the column being named time with a lower case 't'.

 

Example:

2019-01-03 11_05_13-Clipboard.png

 

Any suggestions would be appreciated.

2 Replies
Highlighted
Solution
Hi,

"time" is a reserved word in our query language so it shall be expressed differently:
| extend ['time'] = TimeGenerated

Thanks,
Meir
Highlighted

Perfect! Just what I was looking for. Just tested and I now see the expected results.

 

Thanks a lot :)

Related Conversations
Where Cloudshell issued commands are logged?
jjsantanna in Azure Sentinel on
3 Replies
I am unable to chat and join the calls
prafull13 in Microsoft Teams on
1 Replies
Teams analytics
ThomasSteibl in Microsoft Teams on
4 Replies
Gotta be some better Reporting Options
derekrocco12 in Microsoft Teams on
1 Replies
Screenshare doesn't appear on the recorded meeting
Aktham in Microsoft Teams on
2 Replies