Reputation: 1977
the following code works
let names = dynamic(['Windows Installer', 'Software Protection']);
ConfigurationChange
| where Computer like "SRV"
| where SvcPreviousState == "Running"
| where SvcState == "Stopped"
// | where SvcDisplayName in (names)
| order by TimeGenerated
as commented out I would like to only check for a list of SvcDisplayName's.
According to the documentation this should work but does complain
: Failed to resolve table or column or scalar expression named 'names'
How would I correctly use in with a list for SvcDisplayName ?
Upvotes: 8
Views: 24370
Reputation: 44991
The blank line is considered separator between queries, unless you select the whole code for execution.
See screenshots below.
Select the whole code for execution.
=> Valid query
Put the cursor on the query for execution.
There is no blank line after the let
statement.
=> Valid query
Put the cursor on the query for execution.
There is a blank line after the let
statement.
=> Invalid query
Please note how the query is marked by a pale blue color, but not the let
statement
Upvotes: 7