How to pass dynamic data to the "Where Condtion"

[subrahmanyam kommireddy]

Hi,

Can some one help me how to pass the variable data dynamically in where condition for log analytics query . below query is not executing , it is telling that "Syntax Error"

Example :

let ID = customatable | top 1 by TimeGenerated | summarize by id

search Column = "ABC" | where id == ID | sort by timmegenerated desc

[#2]

I see a couple things that could cause the error.  There is no semicolon at the end of the let statement and TimeGenerated on the second line is incorrect.  It looks like you are referencing custom logs so I can't run it in the demo site to better test.  If you are not already, try running the query in the new "Logs" Blade in the Log Analytics portal.  Analytics has auto-complete and error indication that may help weed out syntax errors.

[#3]

Thank you for response..

Sorry for typo(mistakenly keyed), But I have tried exactly below(semicolon after let statement and correct spelling for TimeGenerated) ,

erro is "'where' operator: Failed to resolve column or scalar expression named 'id' " 

let ID = customatable | top 1 by TimeGenerated | summarize by id;

search Columname = "ABC" | where id == ID | sort by TimeGenerated desc

[#4]

let ID = toscalar(customtable_CL | top 1 by TimeGenerated desc | project id);
customtable_CL | where  Columname == "ABC" and id == ID | order by TimeGenerated desc

[#5 · Accepted solution]

Hi Patrick ,

Sorry for the late reply.. I got other solution... 

And yes It is working as well, appreciate your help.. thank you.