有没有办法将 KQL 结果"flatten"到摘要列中?

  • 本文关键字:flatten KQL 结果 有没有 kql
  • 更新时间 :
  • 英文 :


给定以下数据集,是否有一种简单/有效的方法来使用KQL生成如下的汇总表,理想情况下无需事先知道要使用的实际颜色(即从遇到的数据值生成列名)?

datatable ( name: string, colour: string )[
"alice", "blue",
"bob", "green",
"bob", "blue",
"alice", "red",
"charlie", "red",
"alice", "blue",
"charlie", "red",
"bob", "green"
]
+---------+------+-------+-----+
| name    | blue | green | red |
+---------+------+-------+-----+
| alice   |    2 |     0 |   1 |
| bob     |    1 |     2 |   0 |
| charlie |    0 |     0 |   2 |
+---------+------+-------+-----+

Pivot插件

datatable ( name: string, colour: string )[
"alice", "blue",
"bob", "green",
"bob", "blue",
"alice", "red",
"charlie", "red",
"alice", "blue",
"charlie", "red",
"bob", "green"
]
| evaluate pivot(colour, count(), name)
<表类>名称蓝色绿色红tbody><<tr>爱丽丝201鲍勃120查理002

最新更新