在 Kusto 中投影某些子文档

Question

我有一个时间序列数据，如下所示

"data": {
    "a": {
        "T": [
            1652167964645,
            1652168781684,
            1652168781720,
            1652169266156,
            1652169267146,
            1652169272796,
            1652169299338
        ],
        "V": [
            1,
            2,
            3,
            10,
            6,
            1252,
            1555
        ]
    },
    "b": {
        "T": [
            1652167961657,
            1652168781720,
            1652168781818,
            1652168787377,
            1652168835734,
            1652169266108,
            1652169266125,
            1652169272798,
            1652169299328
        ],
        "V": [
            1,
            3,
            4,
            6,
            12,
            15,
            16,
            17,
            1
        ]
    },
    "c": {
        "T": [
            1652167960194,
            1652168787377,
            1652169266108,
            1652169272798,
            1652169299328
        ],
        "V": [
            1,
            3,
            17,
            18,
            1
        ]
    }}

子文档里面有时间和值 我可以总共处理数据。但如果我只想处理两个子文档，我该怎么做？

我可以像下面这样投影 | project data["a"],data["b"] 但后来我无法处理时间。我怎样才能完成它？

预期输出：

一列是时间，另一列（即 a、b）是值

Time , A , B

0:55, 1,2

Answer 1

let requested_columns = dynamic(["a","b"]);
datatable(data:dynamic)
[
    dynamic
    (
        {
            "a": {
                "T": [
                    1652167964645,
                    1652168781684,
                    1652168781720,
                    1652169266156,
                    1652169267146,
                    1652169272796,
                    1652169299338
                ],
                "V": [
                    1,
                    2,
                    3,
                    10,
                    6,
                    1252,
                    1555
                ]
            },
            "b": {
                "T": [
                    1652167961657,
                    1652168781720,
                    1652168781818,
                    1652168787377,
                    1652168835734,
                    1652169266108,
                    1652169266125,
                    1652169272798,
                    1652169299328
                ],
                "V": [
                    1,
                    3,
                    4,
                    6,
                    12,
                    15,
                    16,
                    17,
                    1
                ]
            },
            "c": {
                "T": [
                    1652167960194,
                    1652168787377,
                    1652169266108,
                    1652169272798,
                    1652169299328
                ],
                "V": [
                    1,
                    3,
                    17,
                    18,
                    1
                ]
            }
        }
    )
]
| mv-expand data
| extend key = tostring(bag_keys(data)[0])
| where key in (requested_columns)
| mv-expand T = data[key].T to typeof(long), V = data[key].V to typeof(long)
| evaluate pivot(key, take_any(V), T)
| order by T asc

T	a	b
1652167961657		1
1652167964645	1
1652168781684	2
1652168781720	3	3
1652168781818		4
1652168787377		6
1652168835734		12
1652169266108		15
1652169266125		16
1652169266156	10
1652169267146	6
1652169272796	1252
1652169272798		17
1652169299328		1
1652169299338	1555

Fiddle