如何取消 kusto/kql/azure 中的列並將多列合二為一

Question

我在 Azure 分析中使用 Kusto 為我正在開發的游戲獲得了一張這樣的表格

datatable (ID_player:string, Timestamp:timespan, monster1:int, monster2:int, monster3:int)
[
     "aaa", "12:00:00", 1,2,3
    ,"aaa", "12:10:00", 4,7,0
    ,"bbb", "12:30:00", 0,2,1
]

基本上，我需要切換到像這樣的格式

ID_Player     Timespamp     Monster     Quantity
aaa           12:00:00      Monster1      1
aaa           12:00:00      Monster2      2
aaa           12:00:00      Monster3     3
aaa           12:10:00      Monster1     4
aaa           12:10:00      Monster2      7
aaa           12:10:00      Monster3      0
bbb           12:30:00      Monster1      0
bbb           12:30:00      monster2      2
bbb           12:30:00      Monster3      1

有什么想法嗎？ 我很難使用一系列 CASE WHEN 但我認為這不是正確的解決方案。 提前致謝！！！

Answer 1

這里有 3 個更直接的解決方案，基於mv-expand & pack_dictionary() / pack_array()

pack_dictionary() + mv-expand kind = array

datatable (ID_player:string, Timestamp:timespan, monster1:int, monster2:int, monster3:int)
[
     "aaa", "12:00:00", 1,2,3
    ,"aaa", "12:10:00", 4,7,0
    ,"bbb", "12:30:00", 0,2,1
]
| mv-expand kind = array monster = pack_dictionary("Monster1", monster1, "Monster2", monster2, "Monster3", monster3)
| extend Monster = tostring(monster[0]), Quantity = toint(monster[1])
| project-away monster*

小提琴

pack_array() x2 + mv- mv-expand

datatable (ID_player:string, Timestamp:timespan, monster1:int, monster2:int, monster3:int)
[
     "aaa", "12:00:00", 1,2,3
    ,"aaa", "12:10:00", 4,7,0
    ,"bbb", "12:30:00", 0,2,1
]
| mv-expand     Monster  = pack_array("Monster1", "Monster2", "Monster3") to typeof(string)
               ,Quantity = pack_array( monster1,   monster2,   monster3 ) to typeof(int)
| project-away  monster*

小提琴

pack_array() + mv-expand with_itemindex

datatable (ID_player:string, Timestamp:timespan, monster1:int, monster2:int, monster3:int)
[
     "aaa", "12:00:00", 1,2,3
    ,"aaa", "12:10:00", 4,7,0
    ,"bbb", "12:30:00", 0,2,1
]
| mv-expand with_itemindex = i Quantity = pack_array(monster1, monster2, monster3) to typeof(int)
| extend Monster = strcat("Monster", tostring(i + 1))  
| project ID_player, Timestamp, Monster, Quantity

小提琴

Answer 2

您可以使用pack()和mv-apply的組合。

例如：

datatable (ID_player:string, Timestamp:timespan, monster1:int, monster2:int, monster3:int)
[
     "aaa", "12:00:00", 1,2,3
    ,"aaa", "12:10:00", 4,7,0
    ,"bbb", "12:30:00", 0,2,1
]
| mv-apply c = pack("monster1", monster1, "monster2", monster2, "monster3", monster3) on (
    extend Monster = tostring(bag_keys(c)[0])
    | extend Quantity = tolong(c[Monster])
)
| project-away monster*, c

ID_player	時間戳	怪物	數量
啊啊啊	12:00:00	怪物1	1
啊啊啊	12:00:00	怪物2	2
啊啊啊	12:00:00	怪物3	3
啊啊啊	12:10:00	怪物1	4
啊啊啊	12:10:00	怪物2	7
啊啊啊	12:10:00	怪物3	0
bbb	12:30:00	怪物1	0
bbb	12:30:00	怪物2	2
bbb	12:30:00	怪物3	1