Kusto：如何将列转换为行并按它们进行汇总

Question

我有一个 table 这样的：-

Type | shown | eaten  |
-----------------------
a    |  5    |   2    |
b    |  6    |   23   |
c    |  8    |   12   |
d    |  19   |   11   |
e    |  2    |   22   |
-----------------------

我想这样转换：-

Type | action | count |
-----------------------
a    | shown  |  5    |
a    | eaten  |  2    |
b    | shown  |  6    |
b    | eaten  |  23   |
c    | shown  |  8    |
c    | eaten  |  12   |
d    | shown  |  19   |
d    | eaten  |  11   |
e    | shown  |  2    |
e    | eaten  |  22   |
-----------------------

如何为此编写 kql 查询？

Answer 1

这是一个选项（请注意，我将一些列名称更改为大写，因此不需要转义）。

datatable(Type: string, shown: int, eaten: int) ["a", 5, 2,
"b", 6, 23,
"c", 8, 12,
"d", 19, 11,
"e", 2, 22]
| extend Temp = pack("shown",shown,"eaten",eaten )
| mv-expand kind=array Temp
| project Type, Action=tostring(Temp[0]), Count=toint(Temp[1])

Answer 2

给你：

let Data = datatable(Type:string, Shown:long, Eaten:long) [
    "a", 5, 2,
    "b", 6, 23,
    "c", 8, 12
];
Data
| project Type, Pack = pack("Shown", Shown, "Eaten", Eaten)
| mv-expand Pack
| extend Action = tostring(bag_keys(Pack)[0])
| project Type, Action, Count = tolong(Pack[Action])

Kusto：如何将列转换为行并按它们进行汇总

Kusto: How to convert columns to rows and summarize by them

kql

azure-data-explorer