column_if_exists throws error "The expression must be constant"

Brass Contributor

Hi,

 

I have the below query in which I want to check if the UserAgent column exists, however I am unable to complete column_if_exists as it underlines in red "UserAgent". Hovering my mouse over it shows  error message  "The expression must be constant. UserAgent:dynamic"

 

How do I resolve this ?

 

AuditLogs
| where TimeGenerated >= ago(7d)
| where InitiatedBy has 'a.b.c.d'
| mv-apply AdditionalDetails on ( where AdditionalDetails.key == "User-Agent"| extend UserAgent=AdditionalDetails.value)
| extend UserAgent_2=column_ifexists(UserAgent, " ") 

 

 

Thank you !!

2 Replies
Trying adding quotes

| extend UserAgent_2=column_ifexists("UserAgent", " ")
This did not work as expected. Instead I used iff and it works

| extend UserAgent= iif( AdditionalDetails.key == "User-Agent", UserAgent=AdditionalDetails.value, " ")