azure-data-explorer - 如何使用条件执行不同的查询以在 Kusto 中查找特定子字符串？

Question

我是 Kusto 的初学者，我正在尝试创建一个查询，该查询fruit基于data包含特定子字符串的另一个 () 列返回一个不同的 () 列。

在下面的示例中，如果在列awesome中找到“”子字符串，则返回该子字符串，如果没有，则返回但始终保持第一列的独特性。data"found""not found"

let Fruit = datatable(fruit:string, data:string) 
[
    "apple", "awesome",
    "apple", "beast",
    "banana", "a beast",
    "orange", "awesome cat",
    "orange", "blah" 
];

所以所需的输出将是：

"apple", "found",
"banana", "not found",
"orange", "found",

Answer 1

一种选择是使用countif()聚合函数，fruit作为聚合键，如下所示：

datatable(fruit:string, data:string) 
[
    "apple", "awesome",
    "apple", "beast",
    "banana", "a beast",
    "orange", "awesome cat",
    "orange", "blah" 
]
| summarize countif(data has 'awesome') by fruit
| project fruit, output = iff(countif_ == 0, "not found", "found")

水果	输出
苹果	成立
香蕉	未找到
橙	成立