Watchlists: failed to resolve scalar expression

[KevinHemelrijk]

Hi Techies,

We want to use a watchlist inside a KQL query which is supposed to be simple, but we are actually struggling a bit with the following issue "'project' operator: Failed to resolve scalar expression named 'emailAddress'". According to the documentation it should look something like this, but it is not working correctly:

Our watchlist looks like this:

Sentinel Docs:

EDIT:

The problem has been solved. We have an invisible space character inside our deployment script which caused the problem. Thanks everyone for helping out, and thanks @Clive_Watson for leading us in the right direction.

[#2]

If you just query this, does it work? That error is usually the Column name not being found by project (and its case sensitive).

_GetWatchlist('VIPUsers') | project emailAddress

[#3]

@Clive_Watson 

Unfortunately that does not work aswell. 

[#4]

Now try it without the project: _GetWatchlist('VIPUsers')

It seems like the Column is named something other than "emailAddresses"

[#5]

@Clive_Watson 

It really is emailAddress ;)

I am starting to think that it is bugged haha

[#6 · Accepted solution]

Thats odd. Will any other Column project ok, such as SearchKey?
Maybe there are some control characters or spaces in the original CSV file, or it's corrupted in some way?

[#7]

How about something like:
_GetWatchlist('VIPUsers') | Summarize make_set(emailAddress)

[#8]

This was the answer. We had a special "space" character in the script deployment which we didn't notice at first cause it was not visible. But thanks to your answer we started checking this again and we got it! Thanks for your help :)