在 KQL 用户函数中使用 column_ifexists
Using column_ifexists in KQL user function
我正在尝试创建一个基于具有动态内容的旋转内容的功能。我的场景示例如下所示:
let countActivities = (col: string) {
array_length(column_ifexists(col, dynamic([])))
};
let testdata = datatable(ActivityId: string, Message: string, SessionId: string)
["1", "abc", "100",
"2", "def", "100",
"2", "ghi", "100",
"4", "jkl", "100",
"1", "mno", "200"];
testdata
| extend iActivityId = toint(ActivityId)
| evaluate pivot(iActivityId, make_set(Message), SessionId)
| project SessionId,
Has1 = countActivities("1"),
Has2 = countActivities("2"),
Has3 = countActivities("3"),
Has4 = countActivities("4");
我想要上面的countActivities
到return动态列数组中元素的数量,但是上面导致错误columnifexists(): cannot be used in the function without tabular argument
。我希望这是一个标量函数,所以不确定如何在这种情况下提供表格参数。
上面的countActivities应该怎么写才能允许这样?
列只能存在于表格表达式中(例如 table)。
您的原始函数没有这样的内容(即 您希望这些列存在哪里?),因此您看到的是错误消息。
下面的选择怎么样?
let f = (arr:dynamic, col: string) {
array_index_of(arr, col) != -1
};
let testdata = datatable(ActivityId: string, Message: string, SessionId: string)
["1", "abc", "100",
"2", "def", "100",
"2", "ghi", "100",
"4", "jkl", "100",
"1", "mno", "200"];
testdata
| summarize make_set(ActivityId) by SessionId
| project SessionId,
Has1 = f(set_ActivityId, "1"),
Has2 = f(set_ActivityId, "2"),
Has3 = f(set_ActivityId, "3"),
Has4 = f(set_ActivityId, "4")
-->
SessionId Has1 Has2 Has3 Has4
100 TRUE TRUE FALSE TRUE
200 TRUE FALSE FALSE FALSE
我正在尝试创建一个基于具有动态内容的旋转内容的功能。我的场景示例如下所示:
let countActivities = (col: string) {
array_length(column_ifexists(col, dynamic([])))
};
let testdata = datatable(ActivityId: string, Message: string, SessionId: string)
["1", "abc", "100",
"2", "def", "100",
"2", "ghi", "100",
"4", "jkl", "100",
"1", "mno", "200"];
testdata
| extend iActivityId = toint(ActivityId)
| evaluate pivot(iActivityId, make_set(Message), SessionId)
| project SessionId,
Has1 = countActivities("1"),
Has2 = countActivities("2"),
Has3 = countActivities("3"),
Has4 = countActivities("4");
我想要上面的countActivities
到return动态列数组中元素的数量,但是上面导致错误columnifexists(): cannot be used in the function without tabular argument
。我希望这是一个标量函数,所以不确定如何在这种情况下提供表格参数。
上面的countActivities应该怎么写才能允许这样?
列只能存在于表格表达式中(例如 table)。 您的原始函数没有这样的内容(即 您希望这些列存在哪里?),因此您看到的是错误消息。
下面的选择怎么样?
let f = (arr:dynamic, col: string) {
array_index_of(arr, col) != -1
};
let testdata = datatable(ActivityId: string, Message: string, SessionId: string)
["1", "abc", "100",
"2", "def", "100",
"2", "ghi", "100",
"4", "jkl", "100",
"1", "mno", "200"];
testdata
| summarize make_set(ActivityId) by SessionId
| project SessionId,
Has1 = f(set_ActivityId, "1"),
Has2 = f(set_ActivityId, "2"),
Has3 = f(set_ActivityId, "3"),
Has4 = f(set_ActivityId, "4")
-->
SessionId Has1 Has2 Has3 Has4
100 TRUE TRUE FALSE TRUE
200 TRUE FALSE FALSE FALSE