在 Kusto 查询中将列名作为参数传递

Question

我需要将列名动态传递到查询中。虽然以下在语法上是正确的，但它并没有真正执行特定列上的条件。

这在 Kusto 中甚至可能吗？

let foo = (duration: timespan, column:string) {
    SigninLogs
    | where TimeGenerated >= ago(duration) 
    | summarize totalPerCol = count() by ['column']
};
//foo('requests')<-- does not work
//foo('user') <-- does not work
//foo('ip')<-- does not work

Answer 1

您可以尝试使用 column_ifexists() 函数：https://docs.microsoft.com/en-us/azure/data-explorer/kusto/query/columnifexists.

例如：

let foo = (column_name:string) {
    datatable(col_a:string)["hello","world"]
    | summarize totalPerCol = count() by column_ifexists(column_name, "")
};
foo('col_a')

col_a	totalPerCol
hello	1
world	1

在 Kusto 查询中将列名作为参数传递

Passing column name as parameter in Kusto query

azure

azure-monitoring

kql

azure-data-explorer