Skip to content

Commit 03b7efc

Browse files
authored
Merge pull request #112311 from vakohl/patch-1
removing square brackets from data testing function instruction
2 parents 5b8b9bd + 2ed68e4 commit 03b7efc

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

articles/sentinel/normalization-develop-parsers.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -425,7 +425,7 @@ Handle the results as follows:
425425
To make sure that your parser produces valid values, use the ASIM data tester by running the following query in the Microsoft Sentinel **Logs** page:
426426

427427
```KQL
428-
<parser name> | limit <X> | invoke ASimDataTester ( ['<schema>'] )
428+
<parser name> | limit <X> | invoke ASimDataTester ('<schema>')
429429
```
430430

431431
Specifying a schema is optional. If a schema is not specified, the `EventSchema` field is used to identify the schema the event should adhere to. Ig an event does not include an `EventSchema` field, only common fields will be verified. If a schema is specified as a parameter, this schema will be used to test all records. This is useful for older parsers that do not set the `EventSchema` field.

0 commit comments

Comments
 (0)