kql

Question

是否可以从字典中获取一组值？

let T = datatable(prop:string, value:string)
[
    "prop01", "val_a",
    "prop02", "val_b",
    "prop03", "val_c",
];
T
| extend p = pack(prop, value)
| summarize dict=make_bag(p)

我需要["val_a","val_b","val_"]

有点像PythonmyDict.values()

Answer 1

您可以使用 mv-apply + make_list() 来实现。

您还可以提交 bag_values() 功能的功能请求@ https://aka.ms/adx.ideas。

datatable(dict:dynamic)
[
    dynamic({
        "prop01": "val_a",
        "prop02": "val_b",
        "prop03": "val_c"
    }), 
]
| mv-apply dict on (
    extend key = tostring(bag_keys(dict)[0])
    | summarize values = make_list(dict[key])
)
| project values

values
[ "val_a", "val_b", "val_c" ]

kql - 从字典中获取所有值

kql - get all values from a dictionary

arrays

dictionary