在 Kusto 中聚合列值

Question

如何转换如下所示的 kusto 数据：

let fauxData = datatable (OrgName:string, Status:string, EastUS:long, SouthCentralUS:long, WestUS2:long)
['Apple', 'Red',    50, 10, 90,
'Apple', 'Orange', 30, 30, 10,
'Apple', 'Yellow', 10, 0, 0,
'Apple', 'Green', 10, 60, 0,
'Ball', 'Red', 20, 20, 20,
'Ball', 'Orange', 30, 30, 30,
'Ball', 'Yellow', 0, 0, 0,
'Ball', 'Green', 50, 50, 50,
];

看起来像这样：

['Apple', 'ComboOfRedandOrange', 80, 40, 100,
'Apple', 'ComboOfGreenandYellow', 20, 60, 0,
'Ball', 'ComboOfRedandOrange', 50, 50, 50,
'Ball', 'ComboOfGreenandYellow', 50, 50, 50,
]

Answer 1

你可以尝试这样的事情：

let T = 
    datatable(OrgName: string, Status: string, EastUS: long, SouthCentralUS: long, WestUS2: long)
    [
        'Apple', 'Red', 50, 10, 90,
        'Apple', 'Orange', 30, 30, 10,
        'Apple', 'Yellow', 10, 0, 0,
        'Apple', 'Green', 10, 60, 0,
        'Ball', 'Red', 20, 20, 20,
        'Ball', 'Orange', 30, 30, 30,
        'Ball', 'Yellow', 0, 0, 0,
        'Ball', 'Green', 50, 50, 50,
    ]
;
let F = (statuses:dynamic)
{
    T
    | where Status in(statuses)
    | summarize sum(EastUS), sum(SouthCentralUS), sum(WestUS2) by OrgName, Status = strcat("ComboOf", strcat_array(statuses, "And"))
}
;
union 
 F(dynamic(['Red', 'Orange'])),
 F(dynamic(['Green', 'Yellow']))
| order by OrgName asc, Status asc

Answer 2

您可以使用下一个查询来实现您的目标：

let fauxData = datatable (OrgName:string, Status:string, EastUS:long, SouthCentralUS:long, WestUS2:long)
['Apple', 'Red',    50, 10, 90,
'Apple', 'Orange', 30, 30, 10,
'Apple', 'Yellow', 10, 0, 0,
'Apple', 'Green', 10, 60, 0,
'Ball', 'Red', 20, 20, 20,
'Ball', 'Orange', 30, 30, 30,
'Ball', 'Yellow', 0, 0, 0,
'Ball', 'Green', 50, 50, 50,
];
fauxData
| extend combo = case(Status in ('Red', 'Orange'), 'ComboOfRedandOrange',
                      Status in ('Green', 'Yellow'), 'ComboOfGreenandYellow',
                     'Unknown')
| summarize sum(EastUS), sum(SouthCentralUS), sum(SouthCentralUS) by OrgName, combo

在 Kusto 中聚合列值

Aggregating Column Values In Kusto

kql

azure-data-explorer