user3732793
user3732793

Reputation: 1977

How to correctly use in for string list in KQL

the following code works

let names = dynamic(['Windows Installer', 'Software Protection']);

ConfigurationChange
| where Computer like "SRV"
| where SvcPreviousState  == "Running"
| where SvcState == "Stopped"
// | where SvcDisplayName in (names)
| order by TimeGenerated

as commented out I would like to only check for a list of SvcDisplayName's.

According to the documentation this should work but does complain

: Failed to resolve table or column or scalar expression named 'names'

How would I correctly use in with a list for SvcDisplayName ?

Upvotes: 8

Views: 24370

Answers (1)

David דודו Markovitz
David דודו Markovitz

Reputation: 44991

The blank line is considered separator between queries, unless you select the whole code for execution.
See screenshots below.

Select the whole code for execution.
=> Valid query

select the code for execution

Put the cursor on the query for execution.
There is no blank line after the let statement.
=> Valid query

put the cursor on the query for execution - without blank line

Put the cursor on the query for execution.
There is a blank line after the let statement.
=> Invalid query

Please note how the query is marked by a pale blue color, but not the let statement

put the cursor on the query for execution - with blank line

Upvotes: 7

Related Questions