SOLVED

Create stored function with parameter

%3CLINGO-SUB%20id%3D%22lingo-sub-1182142%22%20slang%3D%22en-US%22%3ECreate%20stored%20function%20with%20parameter%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1182142%22%20slang%3D%22en-US%22%3E%3CP%3EHi%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAs%20the%20title%20states...%20Is%20this%20possible%20with%20Log%20analytics%20now%3F%20I%20found%20this%20documentation%3A%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fkusto%2Fmanagement%2Fcreate-alter-function%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fkusto%2Fmanagement%2Fcreate-alter-function%3C%2FA%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EBut%20when%20I%20try%20to%20run%20the%20command%20in%20Kusto%20it%20doesn't%20work%20and%20gives%20me%20this%20error%3A%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3EQuery%20could%20not%20be%20parsed%20at%20'.'%20on%20line%20%5B1%2C0%5D%20Token%3A%20.%20Line%3A%201%20Position%3A%200%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3EDo%20I%20need%20to%20create%20Azure%20data%20explorer%20resource%20and%20run%20it%20from%20there%3F%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%3EOr%20is%20this%20a%20bug%20in%20Log%20analytics%3F%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3EThanks!%20%3A)%3C%2Fimg%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1182142%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%20Log%20Analytics%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EKusto%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EQuery%20Language%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1184340%22%20slang%3D%22en-US%22%3ERe%3A%20Create%20stored%20function%20with%20parameter%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1184340%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F563192%22%20target%3D%22_blank%22%3E%40oOMelon%3C%2FA%3E%26nbsp%3B%20this%20feature%20isn't%20supported%20in%20Log%20Analytics%20yet%2C%20but%20is%20planned%20to%20be%20implemented%20in%20the%20coming%20months.%3C%2FP%3E%0A%3CP%3EGenerally%20speaking%2C%20control%20commands%20(listed%20under%20the%20management%20section%20of%20the%20kusto%20documentation%20tree)%20are%20not%20supported%20in%20Log%20Analytics%2C%20it%20will%20be%20done%20in%20another%20way.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1184359%22%20slang%3D%22en-US%22%3ERe%3A%20Create%20stored%20function%20with%20parameter%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1184359%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F54923%22%20target%3D%22_blank%22%3E%40Noa%20Kuperberg%3C%2FA%3E%26nbsp%3BThank%20you%20very%20much%20for%20the%20answer!%20Much%20appreciated%20%3A)%3C%2Fimg%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1455439%22%20slang%3D%22en-US%22%3ERe%3A%20Create%20stored%20function%20with%20parameter%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1455439%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20%40Noa%2C%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EIs%20this%20feature%20-%20saving%20function%20with%20parameter%20support%20-%20avaiable%20now%3F%3CBR%20%2F%3EIf%20not%2C%20could%20you%20please%20share%20expected%20timeline%3F%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThanks.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1610058%22%20slang%3D%22en-US%22%3ERe%3A%20Create%20stored%20function%20with%20parameter%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1610058%22%20slang%3D%22en-US%22%3E%3CP%3EHi%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F263110%22%20target%3D%22_blank%22%3E%40Vino55%3C%2FA%3E%2C%3C%2FP%3E%0A%3CP%3EThe%20feature%20is%20avaialbe%2C%20but%20there's%20no%20UI%20at%20this%20point.%20It%20be%20set%20through%20ARM%20and%20used%20in%20queries.%20See%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fazure%2Fazure-monitor%2Flog-query%2Ffunctions%23function-parameters%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%22%3Ethis%3C%2FA%3E%20for%20more%20details.%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1724439%22%20slang%3D%22en-US%22%3ERe%3A%20Create%20stored%20function%20with%20parameter%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1724439%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F54923%22%20target%3D%22_blank%22%3E%40Noa%20Kuperberg%3C%2FA%3E%26nbsp%3B%3CBR%20%2F%3EFunctions%20with%20parameter%26nbsp%3Bcan%20be%20called%20in%20the%20query%20editor%20in%20the%20portal%20as%20expected%20with%20function_name(param1%2Cparam2)%3CBR%20%2F%3ECurrently%20the%20portal%20offers%20the%20possibility%20to%20copy%20the%20link%20to%20the%20query.%20Is%20it%20possible%20to%20pass%20the%20parameters%20in%20the%20query%20link%20(similar%20to%20what%20you%20have%20today%20for%20the%20timespan%20when%20you%20specify%20the%20time%20range%20-%20e.g.%20%3CLINK%20to%3D%22%22%20query%3D%22%22%20%2F%3E%2Ftimespan%2FP1D).%20If%20not%20-%20are%20there%20any%20plans%20to%20support%20this%20in%20the%20future%20%3F%20This%20would%26nbsp%3B%20be%20very%20helpful%20for%20directly%20filtering%20the%20log%20results%20with%20the%20given%20parameters.%3CBR%20%2F%3EThank%20you%20in%20advance%2C%3CBR%20%2F%3Ebye%20%2F%2Femil.%3C%2FP%3E%3C%2FLINGO-BODY%3E
New Contributor

Hi,

 

As the title states... Is this possible with Log analytics now? I found this documentation: https://docs.microsoft.com/en-us/azure/kusto/management/create-alter-function

 

But when I try to run the command in Kusto it doesn't work and gives me this error: 

Query could not be parsed at '.' on line [1,0] Token: . Line: 1 Position: 0

 

Do I need to create Azure data explorer resource and run it from there? Or is this a bug in Log analytics?

 

Thanks! :) 

5 Replies
best response confirmed by oOMelon (New Contributor)
Solution

@oOMelon  this feature isn't supported in Log Analytics yet, but is planned to be implemented in the coming months.

Generally speaking, control commands (listed under the management section of the kusto documentation tree) are not supported in Log Analytics, it will be done in another way.

 

@Noa Kuperberg Thank you very much for the answer! Much appreciated :)

Hi @Noa,

 

Is this feature - saving function with parameter support - avaiable now?
If not, could you please share expected timeline?

 

Thanks.

Hi @Vino55,

The feature is avaialbe, but there's no UI at this point. It be set through ARM and used in queries. See this for more details. 

@Noa Kuperberg 
Functions with parameter can be called in the query editor in the portal as expected with function_name(param1,param2)
Currently the portal offers the possibility to copy the link to the query. Is it possible to pass the parameters in the query link (similar to what you have today for the timespan when you specify the time range - e.g. <link to query>/timespan/P1D). If not - are there any plans to support this in the future ? This would  be very helpful for directly filtering the log results with the given parameters.
Thank you in advance,
bye //emil.