SOLVED

Escape/Ignore funcitons in Log Analytics

%3CLINGO-SUB%20id%3D%22lingo-sub-308361%22%20slang%3D%22en-US%22%3EEscape%2FIgnore%20funcitons%20in%20Log%20Analytics%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-308361%22%20slang%3D%22en-US%22%3E%3CP%3EHi%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI'm%20trying%20to%20write%20a%20query%20that%20outputs%20a%20column%20named%20%22time%22%20(Notice%20the%20lower%20case%20't').%3CBR%20%2F%3EWhen%20doing%20so%2C%20for%20instance%20with%20the%20%22extend%22%20function%2C%20it%20presents%20me%20with%20a%20syntax%20error%20message%20due%20to%20%22time%22%20being%20a%20function%20in%20Log%20Analytics%20already.%20That%20means%20I'm%20forced%20to%20name%20the%20column%20%22Time%22%20(with%20an%20upper%20case%20'T')%20which%20does%20not%20work%20with%20case%20sensitive%20software%20like%20Grafana%2C%20which%20does%20not%20recognize%20a%20time%20column%20without%20the%20column%20being%20named%20time%20with%20a%20lower%20case%20't'.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSTRONG%3EExample%3A%3C%2FSTRONG%3E%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20408px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F64563i9C13918323DC81A0%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%222019-01-03%2011_05_13-Clipboard.png%22%20title%3D%222019-01-03%2011_05_13-Clipboard.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAny%20suggestions%20would%20be%20appreciated.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-308361%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%20Log%20Analytics%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EQuery%20Language%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-308795%22%20slang%3D%22en-US%22%3ERe%3A%20Escape%2FIgnore%20funcitons%20in%20Log%20Analytics%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-308795%22%20slang%3D%22en-US%22%3E%3CP%3EPerfect!%20Just%20what%20I%20was%20looking%20for.%20Just%20tested%20and%20I%20now%20see%20the%20expected%20results.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%20a%20lot%20%3A)%3C%2Fimg%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-308446%22%20slang%3D%22en-US%22%3ERe%3A%20Escape%2FIgnore%20funcitons%20in%20Log%20Analytics%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-308446%22%20slang%3D%22en-US%22%3EHi%2C%3CBR%20%2F%3E%3CBR%20%2F%3E%22time%22%20is%20a%20reserved%20word%20in%20our%20query%20language%20so%20it%20shall%20be%20expressed%20differently%3A%3CBR%20%2F%3E%7C%20extend%20%5B'time'%5D%20%3D%20TimeGenerated%3CBR%20%2F%3E%3CBR%20%2F%3EThanks%2C%3CBR%20%2F%3EMeir%3C%2FLINGO-BODY%3E
Occasional Contributor

Hi,

 

I'm trying to write a query that outputs a column named "time" (Notice the lower case 't').
When doing so, for instance with the "extend" function, it presents me with a syntax error message due to "time" being a function in Log Analytics already. That means I'm forced to name the column "Time" (with an upper case 'T') which does not work with case sensitive software like Grafana, which does not recognize a time column without the column being named time with a lower case 't'.

 

Example:

2019-01-03 11_05_13-Clipboard.png

 

Any suggestions would be appreciated.

2 Replies
Best Response confirmed by Ali Kristoffer Njie (Occasional Contributor)
Solution
Hi,

"time" is a reserved word in our query language so it shall be expressed differently:
| extend ['time'] = TimeGenerated

Thanks,
Meir

Perfect! Just what I was looking for. Just tested and I now see the expected results.

 

Thanks a lot :)