0

I'm now to Azure, KQL and Log Analytics. I'm trying to run the following query on my tasting Log Analytics workspace but I'm getting this error and I can't get around it.

Error:

'where' operator: failed to resolve scalar expression named 'timeOffsetMin'

Query:

let timeOffsetMin = 7d;
let timeOffsetMax = timeOffsetMin * 2;

AuditLogs | where TimeGenerated > ago(timeOffsetMin) and TimeGenerated < ago(timeOffsetMax);

Thanks for the help.

2 Answers2

1

Since it's possible to have multiple queries in the same editor, when you hit "Run", the editor "tries to guess" which part of the text in the editor you're trying to run. The way it works is that it runs whatever you have between empty lines.

In your case, you have an empty line between the let statements, and the statement that looks into the AuditLogs table.

You have two options to resolve this:

  • The preferred option is to remove the empty line (if you really want some separation between these, then instead of an empty line you can put a comment, by writing // some comment)
  • You can tell the editor which text is your full query by selecting your full query before hitting run
Slavik N
  • 4,705
  • 17
  • 23
0

Highlighting the whole query (in the editor) before running it and reformatting the code solved my issue.

Query:

let timeOffsetMin = 7d;
let timeOffsetMax = timeOffsetMin * 2;

AuditLogs
   | where TimeGenerated > ago(timeOffsetMin) and TimeGenerated < ago(timeOffsetMax);