该函数似乎保存为：

let cfd = () {
    let TimeSpanGranularity = 5m;
    let MinimumEventsInTimeSpan = 500;
    let ErrorRatioThreshold = 0.9;
    let TimeSpanTraces = allTraces
    | where timestamp > ago(TimeSpanGranularity)
    | parse message with * ") " EventText
    | parse EventText with EventName ":" *
    | extend Event=coalesce(EventName,EventText,message)
    | where severityLevel >= 1;
    let ShouldFireData = TimeSpanTraces
    | summarize ErrorOrAboveCount=todecimal(sumif(itemCount, severityLevel>=3)), TotalEventCount=todecimal(sum(itemCount))
    | extend ErrorRatioThreshold
    | extend ErrorRatio=100.0*ErrorOrAboveCount/TotalEventCount
    | project FireAlert = ErrorRatio>=ErrorRatioThreshold and TotalEventCount>=MinimumEventsInTimeSpan;
    let ShouldFire = toscalar(ShouldFireData);
    TimeSpanTraces
    | where ShouldFire == true and severityLevel >=3;
};

而不是

let cfd = () {
    ...
};
cfd();

如果查询的这个特定部分而不是整个查询在UI中突出显示，则可能会发生这种情况。
你能再试一次吗？请注意，在这种情况下，保存的函数体可以简单地为：

let TimeSpanGranularity = 5m;
let MinimumEventsInTimeSpan = 500;
let ErrorRatioThreshold = 0.9;
let TimeSpanTraces = allTraces
| where timestamp > ago(TimeSpanGranularity)
| parse message with * ") " EventText
| parse EventText with EventName ":" *
| extend Event=coalesce(EventName,EventText,message)
| where severityLevel >= 1;
let ShouldFireData = TimeSpanTraces
| summarize ErrorOrAboveCount=todecimal(sumif(itemCount, severityLevel>=3)), TotalEventCount=todecimal(sum(itemCount))
| extend ErrorRatioThreshold
| extend ErrorRatio=100.0*ErrorOrAboveCount/TotalEventCount
| project FireAlert = ErrorRatio>=ErrorRatioThreshold and TotalEventCount>=MinimumEventsInTimeSpan;
let ShouldFire = toscalar(ShouldFireData);
TimeSpanTraces
| where ShouldFire == true and severityLevel >=3;

我也碰到了这个。另外，如果您想添加一个参数，您应该提供一个实际的输入。这对我来说是违反直觉的，因为函数定义通常不需要文字。

// Query that appends a question mark to a provided name parameter
let nameWithQuestionMark = (name:string) {
  print strcat(name, " is it you?")
};
let name = "John";
nameWithQuestionMark(name)

然后使用参数保存查询：

当你像这样调用一个工作簿后：

nameWithQuestionMark('databach');