question

Hi,

It would be nice to be able to simplify my KQL queries by pulling some information out into "let" statements. That is very difficult, right now.

For instance, the following KQL query is more or less adapted directly from the KQL documentation (here).

let start_time = ago(5h); 
let end_time = start_time + 2h; 

['events.all'] | where Timestamp > start_time and Timestamp < end_time

It does not work. I get this error:

Error 

 'where' operator: Failed to resolve column or scalar expression named '["start_time"]'

 clientRequestId: KustoWebV2;d54c841c-6de3-4cd4-a476-6ed283c358af

It's possible I'm doing something wrong and I haven't checked whether this is a limitation of the UI or happening when I hit the API directly.

In any event, it is important to be able to do things like join against data tables defined outside of the primary query at the end of the KQL document. We can't do that if we cannot access objects defined with the let keyword. At least I've not been able to figure out how.

Here are the things I've tried to define with let and been unable to use:

• Constant scalar values
• Data tables
• Functions

Thanks,

Max

***EDIT***

Thanks to @SethDu for figuring out what was going on, here. It's the addition of blank lines.

For instance, this statement works:

let Unrelated = 1;
let Me = datatable (Entity_Id:string)["<my id>"];
['events.all'] | join kind=inner Me on Entity_Id | limit 10

...but this statement doesn't:

let Unrelated = 1;

let Me = datatable (Entity_Id:string)["<my id>"];
['events.all'] | join kind=inner Me on Entity_Id | limit 10

I still assert this is a bug. Note that the query breaks even though Unrelated is not used. The mere presence of a constant definition that is not even used, separated from the rest of the query by a blank line, means that the query will break.

The good news, for whoever stumbles upon this, is that the workaround is as @SethDu said: Just get rid of all your blank lines.