我有一列是一个数组,想要打印不同的计数
Event
| project colors
当前输出
["Red", "Green", "Green", "Red"]
["Yellow", "Yellow", "Yellow", "Yellow"]
预期的
["Red", "Green", "Green", "Red"] , 2
["Yellow", "Yellow", "Yellow", "Yellow"], 1
我有一列是一个数组,想要打印不同的计数
Event
| project colors
当前输出
["Red", "Green", "Green", "Red"]
["Yellow", "Yellow", "Yellow", "Yellow"]
预期的
["Red", "Green", "Green", "Red"] , 2
["Yellow", "Yellow", "Yellow", "Yellow"], 1
这就是我认为你想要的,使用todynamic
and mvexpand
, summarize
(并datatable
创建输入数据)
// create your sample data using datatable to make a 'fake' table
datatable (colors: string) [
'["Red", "Green", "Green", "Red"]',
'["Yellow", "Yellow", "Yellow", "Yellow"]'
]
// this part is answering your question
| extend c = todynamic(colors) // turns colors into arrays
| mvexpand c // expands all the values out of colors into their own rows (but each column value is still "dynamic" type)
| extend c = tostring(c) // turn the dynamic c column to strings to summarize the values
| summarize ["Count"] = dcount(c) by colors // count up distinct c values by each row
这将输出您在问题中的内容:
colors Count
------------------------------------------------
["Red", "Green", "Green", "Red"] 2
["Yellow", "Yellow", "Yellow", "Yellow"] 1