如何检测KQL中的表格变量是否为空

Question

我有一个仪表板，其中填充了许多 Kusto KQL 查询。

有时，我的查询 returns 为零结果（例如，如果奇迹发生，在过去 24 小时内没有失败）。

//my dashboard query 
let failureResults = exceptions | where blahblahblah;
failureResults;

当没有与过滤器匹配的项目时，我的仪表板充满了

'The query returned no Results'.

我怎样才能检查这个变量是否为空然后执行不同的操作？例如，如果它为空，那么我将改为发出 print "No Failures for today, awesome!";。

我已经尝试了 iff() 语句和 isempty(failures| distinct Outcome) 之类的，但没有用。例如，这是另一个不起作用的方法：

failures | project column_ifexists(tostring(Outcome),"No failures where reported!")

Answer 1

嗯...有点...

let p_threshold = ... ;// set value
let failureResults = datatable(exception_id:int,exception_val:int,exception_text:string)[1,100,"Hello" ,2,200,"World"];
failureResults
| where exception_val > p_threshold
| as t1
| union kind=outer (print msg = 'No Failures for today, awesome!' | where toscalar(t1 | take 1 | count) == 0)
| project-reorder msg

让p_threshold = 0;

msg	exception_id	exception_val	exception_text
	1	100	Hello
	2	200	World

让p_threshold = 300;

msg	exception_id	exception_val	exception_text
No Failures for today, awesome!

Fiddle

Answer 2

刚刚想到一个基于pack_all() and the bag_unpack插件的改进解决方案

let p_threshold = ... ;// set value
let failureResults = datatable(exception_id:int,exception_val:int,exception_text:string)[1,100,"Hello" ,2,200,"World"];
failureResults
| where exception_val > p_threshold
| as t1
| project result = pack_all()
| union kind=outer (print msg = 'No Failures for today, awesome!' | where toscalar(t1 | take 1 | count) == 0 | project result = pack_all())
| evaluate bag_unpack(result)

让p_threshold = 0;

exception_id	exception_text	exception_val
1	Hello	100
2	World	200

让p_threshold = 300;

msg
No Failures for today, awesome!

Fiddle

如何检测KQL中的表格变量是否为空

How to detect if Tabular variable is empty in KQL

kql

kusto-explorer