1

任何人都可以提供有关如何在数组中查询值的线索 - 如下所示，我想找到所有记录

DiscoveredInformationTypes_s Confidence > 80

任何人都可以帮忙吗？如何在这个数组中查询？

MachineName_s
Version_s
ProcessName_s
ApplicationName_s
Operation_s
ObjectId_s
DiscoveredInformationTypes_s
[ { "Confidence": 55, "Count": 1, "SensitiveType": "3356946c-6bb7-449b-b253-6ffa419c0ce7", "UniqueCount": 1, "SensitiveInformationDetections": null, "Name": "International Classification of Diseases (ICD-10-CM)" } ]
4

1 回答 1

2

您可以使用mv-apply：https ://docs.microsoft.com/en-us/azure/data-explorer/kusto/query/mv-applyoperator

例如：

datatable(DiscoveredInformationTypes_s:dynamic)
[
    dynamic([ { "Confidence": 55, "Count": 1, "SensitiveType": "3356946c-6bb7-449b-b253-6ffa419c0ce7", "UniqueCount": 1, "SensitiveInformationDetections": null, "Name": "International Classification of Diseases (ICD-10-CM)" } ]),
    dynamic([ { "Confidence": 81, "Count": 1, "SensitiveType": "3356946c-6bb7-449b-b253-6ffa419c0ce7", "UniqueCount": 1, "SensitiveInformationDetections": null, "Name": "International Classification of Diseases (ICD-10-CM)" } ])
]
| mv-apply DiscoveredInformationTypes_s on (
    where DiscoveredInformationTypes_s.Confidence > 80
)

或者，如果您的列是string-typed 而不是dynamic-typed，则需要先调用parse_json()它：

datatable(s:string)
[
    '[ { "Confidence": 55, "Count": 1, "SensitiveType": "3356946c-6bb7-449b-b253-6ffa419c0ce7", "UniqueCount": 1, "SensitiveInformationDetections": null, "Name": "International Classification of Diseases (ICD-10-CM)" } ]',
    '[ { "Confidence": 81, "Count": 1, "SensitiveType": "3356946c-6bb7-449b-b253-6ffa419c0ce7", "UniqueCount": 1, "SensitiveInformationDetections": null, "Name": "International Classification of Diseases (ICD-10-CM)" } ]'
]
| project DiscoveredInformationTypes_s = parse_json(s)
| mv-apply DiscoveredInformationTypes_s on (
    where DiscoveredInformationTypes_s.Confidence > 80
)
于 2021-04-21T15:40:16.390 回答