Sep 20 2018
- last edited on
Apr 07 2022
Can some one help me how to pass the variable data dynamically in where condition for log analytics query . below query is not executing , it is telling that "Syntax Error"
let ID = customatable | top 1 by TimeGenerated | summarize by id
search Column = "ABC" | where id == ID | sort by timmegenerated desc
Sep 20 2018 02:06 PM
I see a couple things that could cause the error. There is no semicolon at the end of the let statement and TimeGenerated on the second line is incorrect. It looks like you are referencing custom logs so I can't run it in the demo site to better test. If you are not already, try running the query in the new "Logs" Blade in the Log Analytics portal. Analytics has auto-complete and error indication that may help weed out syntax errors.
Sep 21 2018 09:27 AM
Thank you for response..
Sorry for typo(mistakenly keyed), But I have tried exactly below(semicolon after let statement and correct spelling for TimeGenerated) ,
erro is "'where' operator: Failed to resolve column or scalar expression named 'id' "
let ID = customatable | top 1 by TimeGenerated | summarize by id;
search Columname = "ABC" | where id == ID | sort by TimeGenerated desc
Sep 26 2018 02:46 PM
let ID = toscalar(customtable_CL | top 1 by TimeGenerated desc | project id);
customtable_CL | where Columname == "ABC" and id == ID | order by TimeGenerated desc
Oct 05 2018 07:20 AM - edited Oct 05 2018 07:21 AMSolution
Hi Patrick ,
Sorry for the late reply.. I got other solution...
And yes It is working as well, appreciate your help.. thank you.