Kusto 查询语言：通过评估表达式设置汇总的列名

Question

Me again asking another Kusto related question (I really wish there would be a thorough video tutorial on this somewhere).

I have a summarize statement, that produces two columns for y axis and one for x axis. Now i want to relabel the columns for x axis to show a string, that i also got from the database and already put into a variable with let .

This basically looks like this:

let android_col = strcat("Android: ", toscalar(customEvents
| where application_Version contains secondLatestVersionAndroid));
let iOS_col = strcat("iOS: ", toscalar(customEvents
| where application_Version contains secondLatestVersionIOS));

... some Kusto magic ...

| summarize
    Android = 100 - (round((countif(hasUnhandledErrorAndroid == 1 ) * 100.0 ) / countif(isAndroid == 1), 2)),
    iOS = 100 - (round((countif(hasUnhandledErroriOS == 1) * 100.0 ) / countif(isIOS == 1), 2))
    by Time
|render timechart with (ytitle="crashfree users in %", xtitle="date", legend=visible )

Now i want to have the summarize display not Android and iOS, but the value of android_col and iOS_col.

Is that possible?

Best regards Maverick

Answer 1

Generally, it's suggested to have predefined column names, otherwise various features don't work. For example, IntelliSense won't know the names of the columns, as they would be determined at run time only. Also, if you create a function that returns a dynamic schema, you won't be able to run this function from other clusters.

However, if you do want to change column names, you definitely have a way to do it by using various plugins. For example, bag_unpack , pivot and others.

As for courses on Kusto, there are actually several excellent courses on Pluralsight (all are free):

• How to start with Microsoft Azure Data Explorer
• Basic KQL
• Azure Data Explorer – Advanced KQL

Answer 2

此查询中“toscalar”的用法看起来不对，在我看来，您应该使用具有相同逻辑的“extend”运算符来创建附加列。