azure - 日志分析用户定义函数返回 'Body of the callable expression cannot be empty'

Question

如下在 Log Analytics 中定义和执行已保存函数时，我可以看到结果:

let cfd = () {
    let TimeSpanGranularity = 5m;
    let MinimumEventsInTimeSpan = 500;
    let ErrorRatioThreshold = 0.9;
    let TimeSpanTraces = allTraces
    | where timestamp > ago(TimeSpanGranularity)
    | parse message with * ") " EventText
    | parse EventText with EventName ":" *
    | extend Event=coalesce(EventName,EventText,message)
    | where severityLevel >= 1;
    let ShouldFireData = TimeSpanTraces
    | summarize ErrorOrAboveCount=todecimal(sumif(itemCount, severityLevel>=3)), TotalEventCount=todecimal(sum(itemCount))
    | extend ErrorRatioThreshold
    | extend ErrorRatio=100.0*ErrorOrAboveCount/TotalEventCount
    | project FireAlert = ErrorRatio>=ErrorRatioThreshold and TotalEventCount>=MinimumEventsInTimeSpan;
    let ShouldFire = toscalar(ShouldFireData);
    TimeSpanTraces
    | where ShouldFire == true and severityLevel >=3;
};
cfd();

但是，保存函数后，并尝试按如下方式调用已保存的函数:

cfd()

我看到以下错误:

“可调用表达式的主体不能为空”

我花了太多时间试图让它发挥作用。.关于我做错了什么有什么想法吗？

Answer 1

看起来该函数被保存为:

let cfd = () {
    let TimeSpanGranularity = 5m;
    let MinimumEventsInTimeSpan = 500;
    let ErrorRatioThreshold = 0.9;
    let TimeSpanTraces = allTraces
    | where timestamp > ago(TimeSpanGranularity)
    | parse message with * ") " EventText
    | parse EventText with EventName ":" *
    | extend Event=coalesce(EventName,EventText,message)
    | where severityLevel >= 1;
    let ShouldFireData = TimeSpanTraces
    | summarize ErrorOrAboveCount=todecimal(sumif(itemCount, severityLevel>=3)), TotalEventCount=todecimal(sum(itemCount))
    | extend ErrorRatioThreshold
    | extend ErrorRatio=100.0*ErrorOrAboveCount/TotalEventCount
    | project FireAlert = ErrorRatio>=ErrorRatioThreshold and TotalEventCount>=MinimumEventsInTimeSpan;
    let ShouldFire = toscalar(ShouldFireData);
    TimeSpanTraces
    | where ShouldFire == true and severityLevel >=3;
};

而不是

let cfd = () {
    ...
};
cfd();

如果在 UI 中突出显示查询的特定部分而不是整个查询，则可能会发生这种情况。

您能再试一次吗？请注意，在这种情况下，保存的函数体可以简单地是:

let TimeSpanGranularity = 5m;
let MinimumEventsInTimeSpan = 500;
let ErrorRatioThreshold = 0.9;
let TimeSpanTraces = allTraces
| where timestamp > ago(TimeSpanGranularity)
| parse message with * ") " EventText
| parse EventText with EventName ":" *
| extend Event=coalesce(EventName,EventText,message)
| where severityLevel >= 1;
let ShouldFireData = TimeSpanTraces
| summarize ErrorOrAboveCount=todecimal(sumif(itemCount, severityLevel>=3)), TotalEventCount=todecimal(sum(itemCount))
| extend ErrorRatioThreshold
| extend ErrorRatio=100.0*ErrorOrAboveCount/TotalEventCount
| project FireAlert = ErrorRatio>=ErrorRatioThreshold and TotalEventCount>=MinimumEventsInTimeSpan;
let ShouldFire = toscalar(ShouldFireData);
TimeSpanTraces
| where ShouldFire == true and severityLevel >=3;