如何透视日志分析数据 (Kusto)

Question

我一直在用头撞墙。我有以下数据（有点像键值对），我需要设置名称列而不是行

let settings = datatable (Location:int , SettingName:string, SettingValue:string)
    [1, "PaperSize", "A4",
     1, "Orientation", "Vertical",
     1, "Colour", "False",
     2, "PaperSize", "A3",
     2, "Orientation", "Vertical",
     2, "Colour", "False",
     3, "PaperSize", "A4",
     3, "Orientation", "Horizontal",
     3, "Colour", "True"];
settings
| evaluate pivot(SettingName)

我期望有 3 行，每个位置一行，每个设置（纸张大小、方向、颜色）加位置一列。但我最终得到了 9 行和没有多大意义的数据。我试图获得的输出是：


+----------+-----------+-------------+--------+
| Location | PaperSize | Orientation | Colour |
+----------+-----------+-------------+--------+
|        1 | A4        | Vertical    | False  |
|        2 | A3        | Vertical    | False  |
|        3 | A4        | Horizontal  | True   |
+----------+-----------+-------------+--------+

真实数据有很多设置，所以理想情况下我不想在查询中硬编码 SettingNames。我看过其他功能，如 bags 和 mv，但没有任何运气。也许这是不可能的，但非常感谢任何想法

Answer 1

你可以通过添加any()聚合来实现（假设你对any-value感到满意）

let settings = datatable (Location:int , SettingName:string, SettingValue:string)
    [1, "PaperSize", "A4",
     1, "Orientation", "Vertical",
     1, "Colour", "False",
     2, "PaperSize", "A3",
     2, "Orientation", "Vertical",
     2, "Colour", "False",
     3, "PaperSize", "A4",
     3, "Orientation", "Horizontal",
     3, "Colour", "True"];
settings
| evaluate pivot(SettingName, any(SettingValue))

如何透视日志分析数据 (Kusto)

How to pivot log analytics data (Kusto)

azure-log-analytics

kql

azure-data-explorer