Using shared user-defined Kusto functions in Log Analytics

2
votes

I have a number of queries in Log Analytics that share a few common parts that I have expressed in functions that I defined. There is a way to save them, but there is a problem invoking them from queries. Specifically, I can save and invoke a subquery, but I cannot save and invoke a scalar function.

For example, suppose I save the following query under name fiveEntries:

StormEvents
| limit 5

I can then invoke it as:

fiveEntries

Now I want to define a scalar function and save it under name value5:

let value5 = () {5};

I cannot invoke it by name and get an error:

StormEvents
| limit value5()

Syntax Error
Body of the callable expression cannot be empty
If issue persists, please open a support ticket.
Request id: 4b79daef-...

It looks like external user-defined scalar (and tabular) functions are not supported (and this seems to be confirmed by another writeup).

My questions:

  1. Is this correct, or is there a way to get this to work?

  2. If this is a real limitation, are there plans to add support for such functions (and when)?

  3. Are there recommended ways of building and maintaining sets of common functions to be used across multiple Log Analytics queries?

Thanks in advance!

1
azureazure-log-analyticsazure-data-explorerkql

1 Answers

2
votes

Best to my knowledge, Stored User-defined Scalar functions are not yet supported. I believe it is worth adding this feature request to the backlog of the Azure Log Analytics.

Links for reference: Kusto Functions Stored Functions User-defined Functions

With regards 3rd point on maintaining common functions across multiple Log Analytics queries - Use Shared Queries option under Save to while saving the query.