Reputation: 6379
I would like to use a variable which contains an array, so I can use it with in
filter.
this works:
traces
| where cloud_RoleName in ("A", "B")
this does not work (syntax error):
let cloudRoleNames = ("A", "B");
traces
| where cloud_RoleName in cloudRoleNames
I would like to use the array as variable to be able to use the same filter in more joins at once. As a workaround I use the first working variant but it is not ideal. I tried various ways - as well via parsing json but nothing works. Am I missing something obvious? Thx
Upvotes: 6
Views: 7423
Reputation: 25895
Try this instead:
let cloudRoleNames = dynamic(["A", "B"]);
traces
| where cloud_RoleName in (cloudRoleNames)
Relevant docs:
Upvotes: 11