0

I'm using Azure Log Analytics to review certain events of interest.

I would like to obtain timestamps from data that meets a certain criteria, and then reuse these timestamps in further queries, i.e. to see what else occurred around these times.

The following query returns the desired results, but I'm stuck at how to use the interestingTimes var to then perform further searches and show data within X minutes of each previously returned timestamp.

let interestingTimes = 
Event
| where TimeGenerated between (datetime(2021-04-01T11:57:22) .. datetime('2021-04-01T15:00:00'))
| where EventID == 1
| parse EventData with * '<Data Name="Image">' ImageName "<" *
| where ImageName contains "MicrosoftEdge.exe"
| project TimeGenerated
;

Any pointers would be greatly appreciated.

shearlynot
  • 81
  • 1
  • 11

1 Answers1

1

interestingTimes will only be available for use in the query where you declare it. You can't use it in another query, unless you define it there as well.

By the way, you can make your query much more efficient by adding a filter that will utilize the built-in index for the EventData column, so that the parse operator will run on a much smaller amount of records:

let interestingTimes = 
Event
| where TimeGenerated between (datetime(2021-04-01T11:57:22) .. datetime('2021-04-01T15:00:00'))
| where EventID == 1
| where EventData has "MicrosoftEdge.exe" // <-- OPTIMIZATION that will filter out most records
| parse EventData with * '<Data Name="Image">' ImageName "<" *
| where ImageName contains "MicrosoftEdge.exe"
| project TimeGenerated
;
Slavik N
  • 4,705
  • 17
  • 23
  • So to use it in another query do I define a new variable pointing to `interestingTimes` or is there a doc you can reference? This is the part I'm new to/struggling with. Thanks. – shearlynot Apr 05 '21 at 11:08
  • The query is sent as a whole from the client to ADX Engine. So all the variables that you need for a query should be defined using `let` statements as part of that query. You can read more info here: https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/letstatement – Slavik N Apr 05 '21 at 15:38