SOLVED

Time Range selection for stored functions via command line possible ?

%3CLINGO-SUB%20id%3D%22lingo-sub-179319%22%20slang%3D%22en-US%22%3ETime%20Range%20selection%20for%20stored%20functions%20via%20command%20line%20possible%20%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-179319%22%20slang%3D%22en-US%22%3E%3CP%3EIs%20there%20a%20way%20to%20select%20the%20Time%20Range%20programmatically%20(not%20via%20the%20drop%20down%20menu%20%22Select%20Time%20Range%22)%20for%20which%20a%20stored%20function%20shall%20be%20executed%20%3F%3C%2FP%3E%0A%3CP%3EEven%20if%20the%20stored%20function%20specifies%20a%20Time%20Range%20in%20the%20query%2C%20when%20invoking%20it%2C%20the%20specified%20Time%20Range%20is%20not%20%22recognized%22.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EExample%3A%3C%2FP%3E%0A%3CP%3E---%20stored%20function%20%22MyCountFunction%22%20---%3C%2FP%3E%0A%3CDIV%3E%0A%3CDIV%3E%3CSPAN%3Elet%20starttime%20%3D%20startofday(ago(%3C%2FSPAN%3E%3CSPAN%3E2%3C%2FSPAN%3E%3CSPAN%3Ed))%3B%3C%2FSPAN%3E%3C%2FDIV%3E%0A%3CDIV%3E%3CSPAN%3Elet%20endtime%20%3D%20endofday(ago(%3C%2FSPAN%3E%3CSPAN%3E1%3C%2FSPAN%3E%3CSPAN%3Ed))%3B%3C%2FSPAN%3E%3C%2FDIV%3E%0A%3CDIV%3E%3CSPAN%3EMyCustomLog_CL%3C%2FSPAN%3E%3C%2FDIV%3E%0A%3CDIV%3E%3CSPAN%3E%7C%20%3C%2FSPAN%3E%3CSPAN%3Ewhere%3C%2FSPAN%3E%3CSPAN%3E%20TimeGenerated%20between(starttime..endtime)%3C%2FSPAN%3E%3C%2FDIV%3E%0A%3CDIV%3E%3CSPAN%3E%7C%20%3C%2FSPAN%3E%3CSPAN%3Ecount%3C%2FSPAN%3E%3C%2FDIV%3E%0A%3CDIV%3E%3CSPAN%3E---%20end%20of%20stored%20function%20---%3C%2FSPAN%3E%3C%2FDIV%3E%0A%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%0A%3CDIV%3E%3CSPAN%3E---%20invocation%20in%20the%20Analytics%20portal%20---%3C%2FSPAN%3E%3C%2FDIV%3E%0A%3CDIV%3E%3CSPAN%3Eworkspace(%22myworkspace%22).MyCountFunction%3C%2FSPAN%3E%3C%2FDIV%3E%0A%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%0A%3CDIV%3E%3CSPAN%3EThe%20Time%20Range%20for%20the%20invocation%20can%20only%20be%20changed%20from%20the%20drop%20down%20menu%20(which%20makes%20a%20programmatic%20query%20impossible).%3CBR%20%2F%3E%3CBR%20%2F%3EDoes%20anyone%20know%20a%20workaround%20for%20this%20%3F%3C%2FSPAN%3E%3C%2FDIV%3E%0A%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%0A%3CDIV%3E%3CSPAN%3Etnx%20%2F%2Femil.%3C%2FSPAN%3E%3C%2FDIV%3E%0A%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%0A%3C%2FDIV%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-179319%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%20Log%20Analytics%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-181724%22%20slang%3D%22en-US%22%3ERe%3A%20Time%20Range%20selection%20for%20stored%20functions%20via%20command%20line%20possible%20%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-181724%22%20slang%3D%22en-US%22%3E%3CP%3Ehi%20Noa%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Ethanks%20-%20you%20are%20right%2C%20the%20API%20call%20works%20perfectly%2C%20the%20bug%20only%20affects%20the%20UI.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThe%20UI%20bug%20should%20not%20be%20a%20problem%2C%20the%20workaround%20you%20proposed%20solves%20it.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%20!%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Ebye%20%2F%2Femil.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-180461%22%20slang%3D%22en-US%22%3ERe%3A%20Time%20Range%20selection%20for%20stored%20functions%20via%20command%20line%20possible%20%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-180461%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20Emil%2C%3C%2FP%3E%0A%3CP%3EYou're%20right.%20This%20seems%20to%20be%20a%20bug%20in%20the%20UI%2C%20caused%20by%20the%20fact%20the%20time%20range%20is%20not%20explicitly%20found%20in%20the%20query%20text%20(makes%20sense%20when%20calling%20functions).%3C%2FP%3E%0A%3CP%3EAs%20a%20workaround%2C%20I%20suggest%20you%20add%20any%20mention%20of%20%22TimeGenerated%22%20in%20your%20query%2C%20such%20as%3A%3C%2FP%3E%0A%3CDIV%3E%0A%3CPRE%3Ecall_to_function()%20%7C%20...%20where%20TimeGenerated%20!%3D%20%22%22%3C%2FPRE%3E%0A%3C%2FDIV%3E%0A%3CDIV%3EFYI%20-%20the%20issue%20should%20not%20occur%20when%20calling%20functions%20programmatically.%3C%2FDIV%3E%0A%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%0A%3CDIV%3EThanks%2C%3C%2FDIV%3E%0A%3CDIV%3ENoa%3C%2FDIV%3E%3C%2FLINGO-BODY%3E
Highlighted
Occasional Contributor

Is there a way to select the Time Range programmatically (not via the drop down menu "Select Time Range") for which a stored function shall be executed ?

Even if the stored function specifies a Time Range in the query, when invoking it, the specified Time Range is not "recognized".

 

Example:

--- stored function "MyCountFunction" ---

let starttime = startofday(ago(2d));
let endtime = endofday(ago(1d));
MyCustomLog_CL
| where TimeGenerated between(starttime..endtime)
| count
--- end of stored function ---
 
--- invocation in the Analytics portal ---
workspace("myworkspace").MyCountFunction
 
The Time Range for the invocation can only be changed from the drop down menu (which makes a programmatic query impossible).

Does anyone know a workaround for this ?
 
tnx //emil.
 
2 Replies
Highlighted

Hi Emil,

You're right. This seems to be a bug in the UI, caused by the fact the time range is not explicitly found in the query text (makes sense when calling functions).

As a workaround, I suggest you add any mention of "TimeGenerated" in your query, such as:

call_to_function() | ... where TimeGenerated != ""
FYI - the issue should not occur when calling functions programmatically.
 
Thanks,
Noa
Highlighted
Solution

hi Noa,

 

thanks - you are right, the API call works perfectly, the bug only affects the UI.

 

The UI bug should not be a problem, the workaround you proposed solves it.

 

Thanks !

 

bye //emil.