May 06 2020
06:20 AM
- last edited on
Apr 08 2022
10:25 AM
by
TechCommunityAP
May 06 2020
06:20 AM
- last edited on
Apr 08 2022
10:25 AM
by
TechCommunityAP
Hello,
I was wondering if its possible to write an if statement in a kql query
for example i have a dropdownlist, and based on the value i want to execute a query
Anyone know how this is done?
May 06 2020 08:08 AM
Where is the drop down list, is it from a Workbook parameter?
There is IIF() https://docs.microsoft.com/en-us/azure/data-explorer/kusto/query/iiffunction
May 08 2020 12:18 AM
Yes my parameter comes from a dropdownlist, i have json values for the dropdownlist
The parameter i will use is called {Honeytoken:label}
What i want to achieve is that based on the dropdownlist value there should be another query be executed.
for example u have this query :
May 10 2020 08:35 AM
May 11 2020 02:24 PM
| extend test = iff("{Honeytoken:label}" == "File","Yes its a file","No its not")
this works but instead of "yes its a file" i would rather return a query and not a string.
each dropdownlist value need to return a different query
May 12 2020 02:18 AM
I've done this another way. I have a parameter called KQLquery, which has the KQL in a JSON drop-down.
Then all you need to do is "Add a query" and use the parameter name {KQLquery} in this case.