如何在kql中将system.string数据类型解压缩为平面字符串



模式显示字段是一个"system.string";它有一个可变数量的元素,就像一个列表列表。我想做的是将其转换为一个普通字符串,并将其存储在一个字段中。仅仅抛出string((并不能切断它。这就像我必须先解压,然后再连接一样。我该怎么做?您可以使用Tags[0]、Tags[1]…引用每个元素。。。。但是存在数量可变的索引。

示例:如何将MoreData插入一个扁平字符串?

datatable(Date:datetime, Event:string, MoreData:dynamic) [
datetime(1910-06-11), "Born", dynamic(["value5", "value6"]),
datetime(1930-01-01), "Enters Ecole Navale", dynamic(["value5", "value6"]),
datetime(1953-01-01), "Published first book", dynamic(["value5", "value6"]),
datetime(1997-06-25), "Died", dynamic(["value5", "value6"]),
]

假设您想要生成"的结果;值5"value6"'作为一根绳子?

datatable(Date:datetime, Event:string, MoreData:dynamic) [
datetime(1910-06-11), "Born", dynamic(["value5", "value6"]),
datetime(1930-01-01), "Enters Ecole Navale", dynamic(["value5", "value6"]),
datetime(1953-01-01), "Published first book", dynamic(["value5", "value6"]),
datetime(1997-06-25), "Died", dynamic(["value5", "value6"]),
]
| extend result = array_strcat(MoreData,',')
更多数据["value5","value6"]["value5","value6"]value5,value6
日期事件结果
1910-06-11T00:00:00Z出生value5,value6
1930-01-01T00:00:00Z进入Ecole Navale
1953-01-01T00:00:00Z出版了第一本书value5,value6
1997-06-25T00:00Z死亡["value5","value6"]

最新更新