Log analytics user-defined function returning 'Body of the callable expression cannot be empty'

user_1188857 0
Viewed 662

When defining and executing a saved function in Log Analytics as follows, I can see results:

let cfd = () {
    let TimeSpanGranularity = 5m;
    let MinimumEventsInTimeSpan = 500;
    let ErrorRatioThreshold = 0.9;
    let TimeSpanTraces = allTraces
    | where timestamp > ago(TimeSpanGranularity)
    | parse message with * ") " EventText
    | parse EventText with EventName ":" *
    | extend Event=coalesce(EventName,EventText,message)
    | where severityLevel >= 1;
    let ShouldFireData = TimeSpanTraces
    | summarize ErrorOrAboveCount=todecimal(sumif(itemCount, severityLevel>=3)), TotalEventCount=todecimal(sum(itemCount))
    | extend ErrorRatioThreshold
    | extend ErrorRatio=100.0*ErrorOrAboveCount/TotalEventCount
    | project FireAlert = ErrorRatio>=ErrorRatioThreshold and TotalEventCount>=MinimumEventsInTimeSpan;
    let ShouldFire = toscalar(ShouldFireData);
    TimeSpanTraces
    | where ShouldFire == true and severityLevel >=3;
};
cfd();

However, after saving the function, and attempting to invoke the saved function as follows:

cfd()

I am seeing the following error:

"Body of the callable expression cannot be empty"

I have spent way too much time trying to get this to work.. Any ideas on what I am doing wrong?

azure-application-insights azure
1 Answers

It looks like the function was saved as:

let cfd = () {
    let TimeSpanGranularity = 5m;
    let MinimumEventsInTimeSpan = 500;
    let ErrorRatioThreshold = 0.9;
    let TimeSpanTraces = allTraces
    | where timestamp > ago(TimeSpanGranularity)
    | parse message with * ") " EventText
    | parse EventText with EventName ":" *
    | extend Event=coalesce(EventName,EventText,message)
    | where severityLevel >= 1;
    let ShouldFireData = TimeSpanTraces
    | summarize ErrorOrAboveCount=todecimal(sumif(itemCount, severityLevel>=3)), TotalEventCount=todecimal(sum(itemCount))
    | extend ErrorRatioThreshold
    | extend ErrorRatio=100.0*ErrorOrAboveCount/TotalEventCount
    | project FireAlert = ErrorRatio>=ErrorRatioThreshold and TotalEventCount>=MinimumEventsInTimeSpan;
    let ShouldFire = toscalar(ShouldFireData);
    TimeSpanTraces
    | where ShouldFire == true and severityLevel >=3;
};

and not

let cfd = () {
    ...
};
cfd();

It may happen if this specific section of the query and not the whole query is highlighted in the UI.

Could you please try again? Please note in this case the saved function body can simply be:

let TimeSpanGranularity = 5m;
let MinimumEventsInTimeSpan = 500;
let ErrorRatioThreshold = 0.9;
let TimeSpanTraces = allTraces
| where timestamp > ago(TimeSpanGranularity)
| parse message with * ") " EventText
| parse EventText with EventName ":" *
| extend Event=coalesce(EventName,EventText,message)
| where severityLevel >= 1;
let ShouldFireData = TimeSpanTraces
| summarize ErrorOrAboveCount=todecimal(sumif(itemCount, severityLevel>=3)), TotalEventCount=todecimal(sum(itemCount))
| extend ErrorRatioThreshold
| extend ErrorRatio=100.0*ErrorOrAboveCount/TotalEventCount
| project FireAlert = ErrorRatio>=ErrorRatioThreshold and TotalEventCount>=MinimumEventsInTimeSpan;
let ShouldFire = toscalar(ShouldFireData);
TimeSpanTraces
| where ShouldFire == true and severityLevel >=3;
user_56232450
Related