Missing _GetWatchlist in default functions

[sentholuke]

When parsing some queries that uses the _GetWatchlist function from Microsoft Sentinel, the parser returns an error in the diagnostics list. Since those functions are default that we cannot export through API, would be great to include them in the default for parsing

[mattwar]

You can add additional functions for the parser to recognize via the GlobalState instance.

[sentholuke]

Thank you for your answer, yes, that's what I did in the end. I realized that it is not possible to export Azure Sentinel default functions, such as _GetWatchlist, to be automatically plugged in the GlobalState instance. So, as a workaround, I copied the definition (by hand from the Log Analytics workspace, which could be painful if we would need to use other default functions in the future) and used it in the parser.
Also, about adding the functions, I read them from file in my workflow, and I realized that, when extracting the function name from the function definition (once the function parsed), the extracted name has a starting whitespace which can lead to matching errors when using KQL code using that function. Here the workaround I applied to avoid saving the function with the whitespace:

var funDecl = KustoCode.ParseAndAnalyze(cleanedContent).Syntax.GetDescendants<FunctionDeclaration>();
if (funDecl.Count > 0)
{
    foreach (var fun in funDecl)
    {
        // Trim is needed, otherwise function name has a whitespace at the BEGINNING.
        var funSymbol = new FunctionSymbol(fun.GetPreviousSibling().GetPreviousSibling().ToString().Trim(), fun.Parameters.ToString(), fun.Body.ToString());

Is it expected? This is only part of the code, I omitted the part not relevant to the error
Thanks in advance
P.S. tell me if you prefer me to open another issue

[mattwar]

All tokens and nodes will have leading whitespace included via the ToString() method. The ToString() outputs all the tokens and whitespace associated with the node in the exact way it was parsed. Whitespace (trivia) is part of the tokens. You can use the ToString() overload that accepts the IncludeTrivia parameter to change this behavior.

However, using ToString() is not a good way to get the name of a declaration. You can get it from the NameDeclaration, NameReference or Name node via the SimpleName property. It will also translate the bracketed names for you. You can also get it from an existing symbol via the Name property.