How to correctly use in for string list in KQL

user_3732793 0
Viewed 1116

the following code works

let names = dynamic(['Windows Installer', 'Software Protection']);

ConfigurationChange
| where Computer like "SRV"
| where SvcPreviousState  == "Running"
| where SvcState == "Stopped"
// | where SvcDisplayName in (names)
| order by TimeGenerated

as commented out I would like to only check for a list of SvcDisplayName's.

According to the documentation this should work but does complain

: Failed to resolve table or column or scalar expression named 'names'

How would I correctly use in with a list for SvcDisplayName ?

kql
1 Answers

The blank line is considered separator between queries, unless you select the whole code for execution.
See screenshots below.

Select the whole code for execution.
=> Valid query

select the code for execution

Put the cursor on the query for execution.
There is no blank line after the let statement.
=> Valid query

put the cursor on the query for execution - without blank line

Put the cursor on the query for execution.
There is a blank line after the let statement.
=> Invalid query

Please not how the query is marked by a pale blue color, but not the let statement

put the cursor on the query for execution - with blank line

user_63364790
Related