将 KQL 数组拆分为多列
Split KQL array into multiple columns
我正在尝试在 Azure Sentinel 的工作簿中构建仪表板。其中一列是 JSON 不同长度的数组。我想拆分该数组,以便数组中的每个元素都成为它自己的列,但我想不出一个好的方法来做到这一点。基本上我想要这个
-----------------------------------
Company | products
-----------------------------------
Apple | [iMac, iPhone, iPad]
Microsoft | [xBox, xBox 360]
Google | [Chromebook]
--------------------------------------
成为
-----------------------------------
Company | product_1 | product_2 | product_3
-----------------------------------
Apple | iMac |iPhone |iPad
Microsoft | xBox |xBox 360 |
Google | Chromebook | |
--------------------------------------
效率不高,但这里有一个选项:
datatable(company:string, products:dynamic)
[
"Apple", dynamic(['iMac', 'iPhone', 'iPad']),
"Microsoft", dynamic(['xBox', 'xBox 360']),
"Google", dynamic(['Chromebook']),
]
| mv-apply with_itemindex=i products on (
extend p = pack(strcat("product_", i+1), products)
| summarize b = make_bag(p)
)
| evaluate bag_unpack(b)
| project-reorder company, product* asc
-->
| company | product_1 | product_2 | product_3 |
|-----------|------------|-----------|-----------|
| Apple | iMac | iPhone | iPad |
| Microsoft | xBox | xBox 360 | |
| Google | Chromebook | | |
我正在尝试在 Azure Sentinel 的工作簿中构建仪表板。其中一列是 JSON 不同长度的数组。我想拆分该数组,以便数组中的每个元素都成为它自己的列,但我想不出一个好的方法来做到这一点。基本上我想要这个
-----------------------------------
Company | products
-----------------------------------
Apple | [iMac, iPhone, iPad]
Microsoft | [xBox, xBox 360]
Google | [Chromebook]
--------------------------------------
成为
-----------------------------------
Company | product_1 | product_2 | product_3
-----------------------------------
Apple | iMac |iPhone |iPad
Microsoft | xBox |xBox 360 |
Google | Chromebook | |
--------------------------------------
效率不高,但这里有一个选项:
datatable(company:string, products:dynamic)
[
"Apple", dynamic(['iMac', 'iPhone', 'iPad']),
"Microsoft", dynamic(['xBox', 'xBox 360']),
"Google", dynamic(['Chromebook']),
]
| mv-apply with_itemindex=i products on (
extend p = pack(strcat("product_", i+1), products)
| summarize b = make_bag(p)
)
| evaluate bag_unpack(b)
| project-reorder company, product* asc
-->
| company | product_1 | product_2 | product_3 |
|-----------|------------|-----------|-----------|
| Apple | iMac | iPhone | iPad |
| Microsoft | xBox | xBox 360 | |
| Google | Chromebook | | |