如何透视日志分析数据(Kusto)

时间:2020-08-10 11:39:29

标签: azure-log-analytics kusto kusto-query-language kql

我一直把头撞在墙上。我有以下数据(类似于键值对的位),我需要将设置名称设置为列而不是行

let settings = datatable (Location:int , SettingName:string, SettingValue:string)
    [1, "PaperSize", "A4",
     1, "Orientation", "Vertical",
     1, "Colour", "False",
     2, "PaperSize", "A3",
     2, "Orientation", "Vertical",
     2, "Colour", "False",
     3, "PaperSize", "A4",
     3, "Orientation", "Horizontal",
     3, "Colour", "True"];
settings
| evaluate pivot(SettingName)

我希望有3行,每个位置一个,以及每个设置(PaperSize,Orientation,Colour)和位置的一列。但是最后我得到了9行和没有多大意义的数据。我想要得到的输出是:


+----------+-----------+-------------+--------+
| Location | PaperSize | Orientation | Colour |
+----------+-----------+-------------+--------+
|        1 | A4        | Vertical    | False  |
|        2 | A3        | Vertical    | False  |
|        3 | A4        | Horizontal  | True   |
+----------+-----------+-------------+--------+

实际数据具有许多设置,因此理想情况下,我不想对查询中的SettingNames进行硬编码。 我看过其他功能,例如bag和mv,但没有运气。也许不可能,但是任何想法都值得赞赏

1 个答案:

答案 0 :(得分:2)

您可以通过添加any()聚合来做到这一点(假设您对任意值感到满意)

let settings = datatable (Location:int , SettingName:string, SettingValue:string)
    [1, "PaperSize", "A4",
     1, "Orientation", "Vertical",
     1, "Colour", "False",
     2, "PaperSize", "A3",
     2, "Orientation", "Vertical",
     2, "Colour", "False",
     3, "PaperSize", "A4",
     3, "Orientation", "Horizontal",
     3, "Colour", "True"];
settings
| evaluate pivot(SettingName, any(SettingValue))