如何使用条件执行不同的查询以在 Kusto 中查找特定的子字符串？

Question

我是 Kusto 的初学者，我正在尝试创建一个查询，该查询 return 是一个基于包含特定子字符串的另一个 (data) 列的不同 (fruit) 列。

在下面的示例中，如果在 data 列中找到“awesome”子字符串，则 return "found" 如果没有，则 return "not found" 但始终保持第一列的独特性。

let Fruit = datatable(fruit:string, data:string) 
[
    "apple", "awesome",
    "apple", "beast",
    "banana", "a beast",
    "orange", "awesome cat",
    "orange", "blah" 
];

因此所需的输出将是：

"apple", "found",
"banana", "not found",
"orange", "found",

Answer 1

一种选择是使用countif()聚合函数，以fruit作为聚合键，如下：

datatable(fruit:string, data:string) 
[
    "apple", "awesome",
    "apple", "beast",
    "banana", "a beast",
    "orange", "awesome cat",
    "orange", "blah" 
]
| summarize countif(data has 'awesome') by fruit
| project fruit, output = iff(countif_ == 0, "not found", "found")

fruit	output
apple	found
banana	not found
orange	found

如何使用条件执行不同的查询以在 Kusto 中查找特定的子字符串？

How do you do a distinct query with a criteria to find a specific substring in Kusto?

kql

azure-data-explorer

kusto-explorer