如何使用 kusto 查询合并两个词典

Question

我希望我能够正确地表达这个问题，因为我对 kusto 还很陌生。基本上，我正在尝试编写一个 kusto 查询，该查询 return 是满足某些要求的字典。我有一个包含多个列（名称、外部、父级）的 table 目标是 return 字典，其中键：名称，值：父级。但是，在某些情况下，“父级”列为空白，如果为真，则值需要为：value:External。目前我有一个查询 returns 两个字典在单独的行中，但我想知道是否可以将它们全部放在一个字典中。我希望我解释得很好，代码如下：

let Query1 = view () {
cluster('mycluster').database('my_database').Sizes
|distinct Name, Size, External
|where isempty( Size)| extend p = pack(Name, External) 
|summarize dict=make_bag(p)};
let Query2 = view (){
cluster('mycluster').database('my_database').Sizes
|distinct Name, Size, External
|where not(isempty( Size))| extend o = pack(Name, Parent) 
|summarize dict=make_bag(o)};
union withsource="TempTableName" Query1, Query2

代码returns:

TempTableName	dict
Query1	{B0: Standard, B12: Standard1, B13: Standard5
Query2	{B1:Basic0, B5: Basic09, B19: Basic12}

Answer 1

您可以使用bag_merge()函数：https://docs.microsoft.com/en-us/azure/data-explorer/kusto/query/bag-merge-function

print d1 = dynamic({"B0": "Standard", "B12": "Standard1", "B13": "Standard5"}),
      d2 = dynamic({"B1":"Basic0", "B5": "Basic09", "B19": "Basic12"})
| project d3 = bag_merge(d1, d2)

d3
{ "B0": "Standard", "B12": "Standard1", "B13": "Standard5", "B1": "Basic0", "B5": "Basic09", "B19": "Basic12" }

或者，您的查询：

let d1 = toscalar(
    cluster('mycluster').database('my_database').Sizes
    | distinct Name, Size, External
    | where isempty(Size)
    | extend p = pack(Name, External) 
    | summarize dict=make_bag(p)
);
let d2 = toscalar(
    cluster('mycluster').database('my_database').Sizes
    | distinct Name, Size, External
    | where not(isempty(Size))
    | extend o = pack(Name, Parent) 
    | summarize dict=make_bag(o)
);
print d = bag_merge(d1, d2)

如何使用 kusto 查询合并两个词典

How To Merge two dictionaries using kusto query

azure-data-explorer

kql

kusto-explorer