I'm trying to create dashboards that users can modify dynamically by changing a set of filters (parameters). I have multiple table stored in a database and I want to get the information across all the tables.
This is what I have so far:
.show database TEST cslschema
| where TableName startswith "prefix_"
| project TableName
| union withsource = T *
| extend Hour = bin(TimeGenerated, 1h)
| summarize VesselCount = count() by VesselName, Hour
This works fine but when I try to make use of the parameters like this:
.show database TEST cslschema
| where TableName startswith "prefix_"
| project TableName
| union withsource = T *
| extend Hour = bin(TimeGenerated, 1h)
| summarize VesselCount = count() by VesselName, Hour
| where VesselName == _vessel_name // -> _vessel_name is a dashboard parameter
then I get:
Request is invalid and cannot be processed: Semantic error: SEM0100: 'where' operator: Failed to resolve column or scalar expression named '_vessel_name'
How can I make use of paramters in my command? is there a way to improve this query?
Thanks for the help
I tried defining functions to use them inside my command but that didn't work. Also, when I try to print the value of _vessel_name
, I can see the value so it definitely exists.
I don't think its possible to due that directly. Dashboard parameters relies on Kusto Query Parameters which are not supported.
Consider using evaluate_show_command("", "") instead, and composing command text with scalar string operations.
The below command for instance invokes .show cluster principals on the current cluster ("." is a special case connection string)