如果在 table 表达式中使用但不在打印中使用，则 Kusto UDF 语法错误

Question

我有一个计算奥秘[tm]。考虑这个 UDF：

let getdomain = (x: string) {
        toscalar(suffixes|where suf contains x|limit 1)
}

如果我将它用作：print(getdomain("something")) 它会按预期工作

如果我将它用作：MyTable | extend domain=getdomain(MyTableColumn1) 它会抛出语法错误

如果我按如下方式更改 UDF，那么 table 表达式突然起作用：

let getdomain = (x: string) {
        toscalar(suffixes|where suf contains "staticstring"|limit 1)
}

如果重要，后缀是字符串的外部数据table

编辑：我想出了这个怪物来克服我无法动态地做到这一点，我的后缀不超过 5 个片段：

| extend 
 seg1=extract(@"(\w+$)",1,hostname),
 seg2=extract(@"([^.]+\.\w+$)",1,hostname),
 seg3=extract(@"([^.]+\.[^.]+\.\w+$)",1,hostname),
 seg4=extract(@"([^.]+\.[^.]+\.[^.]+\.\w+$)",1,hostname),
 seg5=extract(@"([^.]+\.[^.]+\.[^.]+\.[^.]+\.\w+$)",1,hostname)
|extend 
 seg1match=seg1 in (suffixes),
 seg2match=seg2 in (suffixes),
 seg3match=seg3 in (suffixes),
 seg4match=seg4 in (suffixes),
 seg5match=seg5 in (suffixes)
|extend domain=coalesce(
 iff(seg5match, extract(@"([^.]+\.[^.]+\.[^.]+\.[^.]+\.[^.]+\.\w+$)",1,hostname),""),
 iff(seg4match, seg5,"" ),
 iff(seg3match, seg4,""),
 iff(seg2match, seg3, ""),
 iff(seg1match, seg2,""))

Answer 1

我认为您没有看到语法错误。

你遇到的是 restrictions on user defined functions:

User-defined functions can't pass into toscalar() invocation information that depends on the row-context in which the function is called.

如果在 table 表达式中使用但不在打印中使用，则 Kusto UDF 语法错误

Kusto UDF syntax error if used in table expression but not in print

kql

azure-data-explorer