User defined functon

Not applicable

Working with Log Analytics I am trying to convert a query to a user defined function. I have never done that before and examples of user defined functions on the web are pretty rare.


I am getting a syntax error in the parameter list (I think) but do not know why. (The diagnostics are not too helpful.)


Here is the function and the calling requests:


// Determine avg churn rate on selected disk since specified start date and group by time generated in specified units
// Render in selected format later. How to specify in function (what type?)


let GetDiskChurn = (servername:string, agosince:timespan, intervals:timespan, testdisk:string) {
| where Computer == servername
| where TimeGenerated > ago(agosince)
| where InstanceName == testdisk
| where CounterName == “Disk Write Bytes/sec”
| summarize avg(CounterValue) by CounterPath, bin(TimeGenerated, intervals)
// convert into MBps
| extend inMBs = avg_CounterValue / 1000000.0
// round(inMBs, 1)
| project CounterPath, TimeGenerated, inMBs
// | render renderformat later type?
GetDiskChurn (“", agosince = 5h, intervals = 1m, testdisk = "F:")
// Is the error agosince timespan?


GetDiskChurn (“”, agosince = 1d, intervals = 1h, testdisk = "F:", )
GetDiskChurn (“”, agosince = 16h, intervals = 1m, testdisk = "F:")



4 Replies
Also forgot the ; at the end of the let {};
Still does not work.
I tired this with the ; at the end of the let but it still did not work.
Best Response confirmed by Stanislav Zhelyazkov (MVP)

HIi @Deleted ,

Yes there should be ; at the end of the function and you fixed that. I think also the function should container lowercase characters only. I couldn't find information where this is documented. After you fix the name it should work. I've tried it in the demo environment and it works.



@Stanislav Zhelyazkov 

Thanks great help.

I also had some issues with quotes.

The documentation and the diagnostics could use some improvement where User Defined Functions are concerned.