0

有没有办法在 Kusto 中设置 where 子句来获取带有子记录的特定记录

就像我想要凯尔从下面一样

其中地址的代码 = 街道，值 = 授权 AND 代码 = 数字，值 = 55555

    {
    "Firstname": "Bob",
    "lastName": "stevens"
    "address": [
        {
            "code": "street",
            "value": "Olsen"
        },
        {
            "code": "Number",
            "value": "123456"
        }
    },
{
    "Firstname": "Kyle",
    "lastName": "richards"
    "address": [
        {
            "code": "street",
            "value": "grant"
        },
        {
            "code": "Number",
            "value": "55555"
        }
    }
4

1 回答 1

0

您可以尝试使用mv-apply, 并过滤满足条件数量符合预期的记录：

datatable(i:int, d:dynamic)
[
    1, dynamic({"Firstname": "Bob",  "lastName": "stevens",  "address": [{ "code": "street", "value": "Olsen" }, { "code": "Number", "value": "123456" }]}),
    2, dynamic({"Firstname": "Kyle", "lastName": "richards", "address": [{ "code": "street", "value": "grant" }, { "code": "Number", "value": "55555"  }]}),
    3, dynamic({"Firstname": "Kyle", "lastName": "richards", "address": [{ "code": "street", "value": "grant" }, { "code": "Number", "value": "11111"  }]})
]
| mv-apply address = d.address on (
    summarize c = countif((address.code == 'street' and address.value == 'grant') or 
                          (address.code == 'Number' and address.value == 55555))
    | where c == 2
)
| project-away c
一世 d
2 {
“名字”：“凯尔”，“姓氏”：
“理查兹”，
“地址”：[
{
“代码”：“街道”，
“价值”：“授予”
}，
{
“代码”：“号码”，
“价值”：“55555”
}
]
}

更新：回复您的评论：

我正在尝试使用 sproc 执行此操作，我需要将其放入数据表中然后像这样查询它吗？如果是这样，我如何将查询放入数据表中

首先，Kusto 中没有存储过程。有存储功能。

其次，如果您想在现有表上调用类似的逻辑，您可以定义一个存储函数，该函数将表格参数作为其输入。并且，可选地，使用invoke操作符。

例如：

.create function my_function(T:(d:dynamic)) {
    T
    | mv-apply address = d.address on (
        summarize c = countif((address.code == 'street' and address.value == 'grant') or 
                              (address.code == 'Number' and address.value == 55555))
        | where c == 2
    )
    | project-away c
}

let my_table = datatable(i:int, d:dynamic)
[
    1, dynamic({"Firstname": "Bob",  "lastName": "stevens",  "address": [{ "code": "street", "value": "Olsen" }, { "code": "Number", "value": "123456" }]}),
    2, dynamic({"Firstname": "Kyle", "lastName": "richards", "address": [{ "code": "street", "value": "grant" }, { "code": "Number", "value": "55555"  }]}),
    3, dynamic({"Firstname": "Kyle", "lastName": "richards", "address": [{ "code": "street", "value": "grant" }, { "code": "Number", "value": "11111"  }]})
];
my_table
| invoke my_function()
于 2022-01-19T20:53:48.640 回答