Dec 06 2022 06:54 PM
Hi,
I have the below query in which I want to check if the UserAgent column exists, however I am unable to complete column_if_exists as it underlines in red "UserAgent". Hovering my mouse over it shows error message "The expression must be constant. UserAgent:dynamic"
How do I resolve this ?
AuditLogs
| where TimeGenerated >= ago(7d)
| where InitiatedBy has 'a.b.c.d'
| mv-apply AdditionalDetails on ( where AdditionalDetails.key == "User-Agent"| extend UserAgent=AdditionalDetails.value)
| extend UserAgent_2=column_ifexists(UserAgent, " ")
Thank you !!
Dec 07 2022 02:39 AM
Dec 07 2022 01:36 PM