Kusto Query Language: Get keyword that was matched (has_any)

Question

I am feeding a csv file in my KQL as an external data source. I run a query to match a column:

Events | where Title has_any (ColumnName) | project Title, EventId

Now, I want to join the output with the column value that was matched. Like if column has values: "test","test2","test3" and "test2" was matched in the above query, result table should be something like:

Title,EventId,MatchedColumnValue

Please help

Answer 1

Here is how to do it using the has_any_index() function:

let Values = dynamic(["title1", "title2", "title3"]);
let Events = datatable(EventId:int, Title:string)[1,"this is title2, and its boring", 2, "title3 is great", 3, "Nothing to find"];
Events
| extend Idx = has_any_index(Title, Values)
| extend MatchedTitle = iif(Idx<0, "", tostring(Values[Idx]))
| project-away Idx