Microsoft Security Tech Accelerator
Dec 06 2023, 07:00 AM - 12:00 PM (PST)
Microsoft Tech Community

column_if_exists throws error "The expression must be constant"

Copper Contributor



I have the below query in which I want to check if the UserAgent column exists, however I am unable to complete column_if_exists as it underlines in red "UserAgent". Hovering my mouse over it shows  error message  "The expression must be constant. UserAgent:dynamic"


How do I resolve this ?


| where TimeGenerated >= ago(7d)
| where InitiatedBy has 'a.b.c.d'
| mv-apply AdditionalDetails on ( where AdditionalDetails.key == "User-Agent"| extend UserAgent=AdditionalDetails.value)
| extend UserAgent_2=column_ifexists(UserAgent, " ") 



Thank you !!

2 Replies
Trying adding quotes

| extend UserAgent_2=column_ifexists("UserAgent", " ")
This did not work as expected. Instead I used iff and it works

| extend UserAgent= iif( AdditionalDetails.key == "User-Agent", UserAgent=AdditionalDetails.value, " ")