I have stumbled upon a very strange issue when using watchlists.
I have a watchlist with 2 columns (userPrincipalName,allowedActivity) that I am then using to whitelist activities.
Watchlist is imported using:
let WhitelistedUsers = _GetWatchlist("testQuery") | project userPrincipalName, allowedActivity;
Then I wanted to set it to a specific time frame to test it on given data set:
set query_now = datetime("1/14/2022, 1:45:46.556 PM");
Problem is that when setting my query for a specific time, I get the following error from the watchlist:
'project' operator: Failed to resolve scalar expression named 'userPrincipalName'. Commenting the set query_now solves the project problem (not my problem though).
I tried to set the time before and after watchlist import but that does not solve the issue. I could not find any posts around the topic (quite a specific one), so anyone observed similar behaviors or has a possible explanation? I can probably work around the set query_now with other functions but I gotten used to it, and find this behavior extremely strange