Skip to content

Authenticated User Timeline Workbook - Parse Error #1982

@jackwagons

Description

@jackwagons

The Authenticated User Timeline Workbook does not escape UserId in Session Timeline sec.

KQL snippet:

set query_take_max_records=10001;set truncationmaxsize=67108864;
let monthName = (month:int) {
case(
month == 1, 'January',
month == 2, 'February',
month == 3, 'March',
month == 4, 'April',
month == 5, 'May',
month == 6, 'June',
month == 7, 'July',
month == 8, 'August',
month == 9, 'September',
month == 10, 'October',
month == 11, 'November',
month == 12, 'December',
''
)
};
union customEvents, pageViews
| where timestamp > ago(1d)
| where user_AuthenticatedId == 'domain\testuser' // needs to be escaped
| where name in ('') or '' in ('*')
| summarize Activities = count(), Start = min(timestamp) by SessionId = session_Id
| order by Start desc
| project ['Session Start'] = strcat('⌚ ', monthName(monthofyear(Start)), ' ', dayofmonth(Start), ', ', tolower(format_datetime(Start, 'h:mm tt'))), Activities, SessionId
//'⌚'

Is the expectation that the source data is responsible for escaping?
If not, is there an accepted pattern or utility in other Workbooks?

Happy to submit a PR based on feedback.

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions