Is there a way for case function in Kusto?

Question

There is no column in table MmsPoolProperty in Azure Data Explorer stating pool type, so I need to extract the substring from pool name to check if the pool is internal or public.

If pool name contains substring "imc" it's private and if contains "pmc" or "ghmc" is public.

MmsPoolProperty
| where TIMESTAMP > ago(1d)
| where ImageName contains "mac" or ImageName contains "osx"
| summarize arg_max(TIMESTAMP, AllPropertiesBlob) by PoolName // We can get rid of this once the decoupling has been rolled out for long enough that we don't have old telemetry
| extend props = parse_json(AllPropertiesBlob)
| project PoolName, UnitName = coalesce(props["VmControllerName"], PoolName) 
| extend PoolType = case(PoolName contains "imc","Internal",
                         PoolName contains "pmc","Public",
                         PoolName contains "ghmc","Public")

Answer 1

The case() function requires a default value as the last argument, add something like this at the end:

| extend PoolType = case(PoolName contains "imc","Internal",
                         PoolName contains "pmc","Public",
                         PoolName contains "ghmc","Public",
                         "Unknown")