Kusto set variable output of query

Question

Looking to define a variable to hold the outut of a query and then query traces from it. Something like this:

let start=datetime("2020-10-07T15:01:00.000Z");
let end=datetime("2020-10-09T13:20:00.000Z");
let timeGrain=1h;
let dataset = dependencies
| where timestamp > start and timestamp < end and ['type'] == 'HTTP' and success == false
| where name contains "mgw/capture"
| project operation_ParentId
traces
| join kind=inner(dataset) on operation_ParentId

Is this possible?

Answer 1

Yes, it's possible, and you even almost got it right, you're just missing a ; at the end of the relevant let statement.

Try this:

let start=datetime("2020-10-07T15:01:00.000Z");
let end=datetime("2020-10-09T13:20:00.000Z");
let timeGrain=1h;
let dataset = dependencies
| where timestamp > start and timestamp < end and ['type'] == 'HTTP' and success == false
| where name contains "mgw/capture"
| project operation_ParentId;
traces
| join kind=inner(dataset) on operation_ParentId