在Kusto中​​汇总列值

问题描述

如何转换如下所示的kusto数据：

let fauxData = datatable (OrgName:string,Status:string,EastUS:long,SouthCentralUS:long,WestUS2:long)
['Apple','Red',50,10,90,'Apple','Orange',30,'Yellow','Green',60,'Ball',20,];

看起来像这样：

['Apple','ComboOfRedandOrange',80,40,100,'ComboOfGreenandYellow',]

解决方法

您可以使用下一个查询来实现您的目标：

let fauxData = datatable (OrgName:string,Status:string,EastUS:long,SouthCentralUS:long,WestUS2:long)
['Apple','Red',50,10,90,'Apple','Orange',30,'Yellow','Green',60,'Ball',20,];
fauxData
| extend combo = case(Status in ('Red','Orange'),'ComboOfRedandOrange',Status in ('Green','Yellow'),'ComboOfGreenandYellow','Unknown')
| summarize sum(EastUS),sum(SouthCentralUS),sum(SouthCentralUS) by OrgName,combo

,

您可以尝试这样的事情：

let T = 
    datatable(OrgName: string,Status: string,EastUS: long,SouthCentralUS: long,WestUS2: long)
    [
        'Apple',]
;
let F = (statuses:dynamic)
{
    T
    | where Status in(statuses)
    | summarize sum(EastUS),sum(WestUS2) by OrgName,Status = strcat("ComboOf",strcat_array(statuses,"And"))
}
;
union 
 F(dynamic(['Red','Orange'])),F(dynamic(['Green','Yellow']))
| order by OrgName asc,Status asc