CODEWITHSUNDEEP
azure-data-explorerkql
Konrads
Konrads

Reputation: 2274

Kusto UDF syntax error if used in table expression but not in print

I have a computational mystery[tm]. Consider this UDF:

let getdomain = (x: string) {
        toscalar(suffixes|where suf contains x|limit 1)
}

If I use it as: print(getdomain("something")) it works as expected

If I use it as: MyTable | extend domain=getdomain(MyTableColumn1) it throws a syntax error

If I make a change to the UDF as follows, then the table expression suddenly works:

let getdomain = (x: string) {
        toscalar(suffixes|where suf contains "staticstring"|limit 1)
}

if it matters, suffixes is an externaldata table of strings

EDIT: I came up with this monstrosity to overcome with my inability to do this dynamically, my suffixes have no more than 5 segments:

| extend 
 seg1=extract(@"(\w+$)",1,hostname),
 seg2=extract(@"([^.]+\.\w+$)",1,hostname),
 seg3=extract(@"([^.]+\.[^.]+\.\w+$)",1,hostname),
 seg4=extract(@"([^.]+\.[^.]+\.[^.]+\.\w+$)",1,hostname),
 seg5=extract(@"([^.]+\.[^.]+\.[^.]+\.[^.]+\.\w+$)",1,hostname)
|extend 
 seg1match=seg1 in (suffixes),
 seg2match=seg2 in (suffixes),
 seg3match=seg3 in (suffixes),
 seg4match=seg4 in (suffixes),
 seg5match=seg5 in (suffixes)
|extend domain=coalesce(
 iff(seg5match, extract(@"([^.]+\.[^.]+\.[^.]+\.[^.]+\.[^.]+\.\w+$)",1,hostname),""),
 iff(seg4match, seg5,"" ),
 iff(seg3match, seg4,""),
 iff(seg2match, seg3, ""),
 iff(seg1match, seg2,""))

Upvotes: 0

Views: 630

Answers (1)

Yoni L.
Yoni L.

Reputation: 25905

i don't think you're seeing a syntax error.

rather you're encountering restrictions on user defined functions:

User-defined functions can't pass into toscalar() invocation information that depends on the row-context in which the function is called.

Upvotes: 1

Related Questions