0

How can I use a tabular type in an in conditional statement? See the last condition in the second query below: Computer in clusterNodes. I get the following syntax error:

Query could not be parsed at 'in' on line [9,181]

Token: in Line: 9 Position: 181

let clusterNodes = 
KubeNodeInventory
| where TimeGenerated > ago(7d)
| where ClusterName == "test-aks"
| distinct Computer;

Perf
| where TimeGenerated > ago(1d) 
| where CounterName == "cpuUsageNanoCores" and ObjectName == "K8SNode" and Computer in clusterNodes 
| summarize ValueAvg = avg(CounterValue) by Time = bin(TimeGenerated, 15m), Counter = CounterName
| project round(ValueAvg / 1000000000, 2), Time, Counter 
| render timechart;
Dave New
  • 38,496
  • 59
  • 215
  • 394

1 Answers1

0

The following should help to leverage in in this scenario:

| where … and Computer in (clusterNodes)

P.S. You may also need to remove an empty row between let and the rest of the query (depending on how you select the query in UI to execute).

Dmitry Matveev
  • 2,563
  • 11
  • 16