Kusto error - has_any(): failed to cast argument 2 to scalar constant

rick l 0
Viewed 25

I am trying to use has_any in sentinel to pass a list (comma delimited) of IPs to a query in a workbook. The IP values will be passed into the query from a workbook parameter that the user enters.

With the below test code, if I use BadIPList variable for the has_any expression, I get the error "has_any(): failed to cast argument 2 to scalar constant"

If I use BadIPList2 it works fine, although they should be the same once I convert BadIPList to a Dynamic type.

    let StartTime = "2022-08-07";
let TimeOffset = 4d;
let BadIPList = '10.1.1.100,10.1.1.102,10.1.1.110,10.1.1.120';
let BadIPlist2 = dynamic(['10.1.1.100','10.1.1.102','10.1.1.110','10.1.1.120']);
DeviceNetworkEvents
| extend BadIPList=todynamic(split(BadIPList,","))
| where TimeGenerated between (startofday(todatetime(StartTime)) .. endofday(todatetime(StartTime) + TimeOffset))
//next line errors
//| where RemoteIP has_any(BadIPList)
//next line works
| where RemoteIP has_any(BadIPlist2)
| project RemoteIP, BadIPList, BadIPlist2
| take 10
//verify variable types
| extend ipType = gettype(BadIPList), ipType2 = gettype(BadIPlist2)
| getschema

output of BadIPList2

I have checked the types of the two variables (Using gettype and getschema), and they seem to be the same any ideas about what I have done wrong?

DataTypes for variables

azure-sentinel kql
1 Answers

As the error message notes, the parameter should be a "scalar constant" (and not a row-level expression)

// Data sample generation. Not part of the solution.
let DeviceNetworkEvents = datatable(RemoteIP:string)["yada yada 10.1.1.102 yada"];
// Solution starts here
let BadIPList = '10.1.1.100,10.1.1.102,10.1.1.110,10.1.1.120';
let BadIPList_split = split(BadIPList, ",");
DeviceNetworkEvents
| where RemoteIP has_any(BadIPList_split)
RemoteIP
yada yada 10.1.1.102 yada

Fiddle

David דודו Markovitz0
Related