Share via

invoking | summarize d= make_set(DeviceId) returning null values from API. If I convert make_set to tostring then results are appearing. | summarize d= tostring(make_set(DeviceId)) but the d is becoming string.

Balaji Thambisetty 1 Reputation point
2022-08-04T06:47:40.5+00:00

228443-sample-query.pngAPI details:
https://api-eu.securitycenter.windows.com/api/advancedqueries/run
KQL

invoking | summarize d= make_set(DeviceId) returning null values from API.
If I convert make_set to tostring then results are appearing. | summarize d= tostring(make_set(DeviceId)) but the d is becoming string.
there is no issue when I use make_set in kusto explorer only issue when I invoked the query from API. it was working fine until 13th of june.
Also issue with make_list, make_bag

Windows 10 Security
Windows 10 Security
Windows 10: A Microsoft operating system that runs on personal computers and tablets.Security: The precautions taken to guard against crime, attack, sabotage, espionage, or another threat.
2,807 questions
Microsoft Defender for Cloud
Microsoft Defender for Cloud
An Azure service that provides threat protection for workloads running in Azure, on-premises, and in other clouds. Previously known as Azure Security Center and Azure Defender.
1,238 questions
Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,023 questions

3 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Limitless Technology 39,466 Reputation points
    2022-08-05T07:57:02.827+00:00

    Hi there,

    Some quick points that you can have a look at:

    -Check that your connection to the API is correct, before parsing the object, via logging the response.
    -Check that your parsed object is correct (AKA, not null). Via logging the object.toString(). print(tank.toString()) in your case before returning the value.
    -Check-in your Main that the value returned is not null

    -----------------------------------------------------------------------------------------------------------------------------

    --If the reply is helpful, please Upvote and Accept it as an answer–

  2. Ian Xue (Shanghai Wicresoft Co., Ltd.) 32,236 Reputation points Microsoft Vendor
    2022-08-17T09:50:56.067+00:00

    Hi,

    You may give a try to the parse_json() which interprets a string as a JSON value and returns the value as dynamic.
    https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/parsejsonfunction

    Best Regards,
    Ian Xue

    -----------------------------

    If the Answer is helpful, please click "Accept Answer" and upvote it.
    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

    0 comments
  3. Ian Xue (Shanghai Wicresoft Co., Ltd.) 32,236 Reputation points Microsoft Vendor
    2022-08-17T09:50:56.257+00:00

    Hi,

    You may give a try to the parse_json() which interprets a string as a JSON value and returns the value as dynamic.
    https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/parsejsonfunction

    Best Regards,
    Ian Xue

    -----------------------------

    If the Answer is helpful, please click "Accept Answer" and upvote it.
    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

    0 comments