microsoft / jupyter-Kqlmagic

Extension (Magic) to Jupyter notebook and Jupyter lab, that enable notebook experience working with Kusto, ApplicationInsights, and LogAnalytics data.
Other
85 stars 31 forks source link

KQL Parser Doesn't Handle Kusto Lambdas #65

Closed slaymaker1907 closed 3 years ago

slaymaker1907 commented 3 years ago

It looks like it just gets rid of the lambda expression and doesn't send it to the server.

%%kql
let PrettyDuration = (duration:timespan) {
    //strcat()
    format_timespan(duration, 'm')
};

MonLogin
| where logical_server_name  == ""
| where database_name =~ "" and event == "process_login_finish"
| where originalEventTimestamp  > ago(2d)
| where is_success == true and is_user_error == false
| summarize count=count(), last_ts=max(originalEventTimestamp) by ['state'], error, state_desc, NodeRole, package, lookup_state, AppName
| extend time_since = PrettyDuration(now() - last_ts)
| project-reorder ['count'], *, last_ts

The above query works when I run it with Kusto.Explorer but fails when running with Kqlmagic.

mbnshtck commented 3 years ago

If you want the lambda to be part of the same query, you should remove the empty line between the lambda definition and the query body. An empty line in %%kql is interpreted as a separator between different queries.