简体   繁体   中英

KQL change order of columns in evaluate pivot

I have the following query:

let fooTable = datatable(TIMESTAMP: datetime, list_id: int, dim_count: int) [
    datetime("2022-01-17T08:00:00Z"), -1, 120,
    datetime("2022-01-17T08:00:00Z"), 1, 50,
    datetime("2022-01-17T08:00:00Z"), 2, 30,
    datetime("2022-01-17T08:00:00Z"), 8, 30,
    datetime("2022-01-17T08:00:00Z"), 2001, 30,
    datetime("2022-01-17T08:00:00Z"), 4, 30,
];
fooTable
| order by TIMESTAMP desc, dim_count desc 
| evaluate pivot(list_id, take_any(dim_count), TIMESTAMP)

If the order is based on the row_number , you can use it with the project-reorder operator, the client will need to parse the column names and remove the prefix, for example:

let fooTable = datatable(TIMESTAMP: datetime, list_id: int, dim_count: int) [
    datetime("2022-01-17T08:00:00Z"), -1, 120,
    datetime("2022-01-17T08:00:00Z"), 1, 50,
    datetime("2022-01-17T08:00:00Z"), 2, 30,
    datetime("2022-01-17T08:00:00Z"), 8, 30,
    datetime("2022-01-17T08:00:00Z"), 2001, 30,
    datetime("2022-01-17T08:00:00Z"), 4, 30,
];
fooTable
| serialize 
| extend list_id = strcat(row_number(), "_", list_id)
| order by TIMESTAMP desc, dim_count desc 
| evaluate pivot(list_id, take_any(dim_count), TIMESTAMP)
| project-reorder *
TIMESTAMP 1_-1 2_1 3_2 4_8 5_2001 6_4
2022-01-17 08:00:00.0000000 120 50 30 30 30 30

The technical post webpages of this site follow the CC BY-SA 4.0 protocol. If you need to reprint, please indicate the site URL or the original address.Any question please contact:yoyou2525@163.com.

 
粤ICP备18138465号  © 2020-2024 STACKOOM.COM