I'm now to Azure, KQL and Log Analytics. I'm trying to run the following query on my tasting Log Analytics workspace but I'm getting this error and I can't get around it.
Error:
'where' operator: failed to resolve scalar expression named 'timeOffsetMin'
Query:
let timeOffsetMin = 7d;
let timeOffsetMax = timeOffsetMin * 2;
AuditLogs | where TimeGenerated > ago(timeOffsetMin) and TimeGenerated < ago(timeOffsetMax);
Thanks for the help.
Since it's possible to have multiple queries in the same editor, when you hit "Run", the editor "tries to guess" which part of the text in the editor you're trying to run. The way it works is that it runs whatever you have between empty lines.
In your case, you have an empty line between the let
statements, and the statement that looks into the AuditLogs
table.
You have two options to resolve this:
// some comment
)