我怎样才能填写kusto

Question

我希望我的 kusto 查询能够记住 return，即当我从日志中解析或提取字段时向下填充最后一个非空值或非空值。

datatable (Date:datetime, LogEntry:string) [ 
  datetime(1910-06-11), "version: 1.0",
  datetime(1930-01-01), "starting foo",
  datetime(1953-01-01), "ending foo",
  datetime(1910-06-11), "version: 2.0",
  datetime(1930-01-01), "starting foo",
  datetime(1953-01-01), "ending foo" ]
| parse LogEntry with 'version: ' Version
| project Date, Version, LogEntry

有办法吗？

Answer 1

抱歉耽搁了，您在找这样的东西吗：

let sampleData = datatable (Date:datetime, LogEntry:string) [ 
  datetime(1910-06-11), "version: 1.1",
  datetime(1930-01-01), "starting foo",
  datetime(1953-01-01), "ending foo",
  datetime(1910-06-11), "version: 2.1",
  datetime(1930-01-01), "starting foo",
  datetime(1953-01-01), "ending foo",
  datetime(1950-01-01), "version: 3.1"]
| parse LogEntry with 'version: ' Version:double
| order by Date asc
| extend rn = row_number()
| extend rn = iif(isempty(Version),0 , rn)
| extend rn = row_cumsum(rn, rn!=0);
sampleData
| project-away Version
| lookup (sampleData | where isnotempty(Version) ) on rn
| project-away Date1, LogEntry1, rn

这是输出：

我怎样才能填写kusto

How can I fill down in kusto

azure-data-explorer