How would I look up an entire column by name and add that data to another table?

56 Views Asked by At

In KQL, given:

let A = datatable(XName:string, YName:string) [
"XData", "YData1",
"XData", "YData2",
];
let B = datatable(XData:double, YData1:double, YData2:double) [
0.0, 1.0, 2.0,
0.1, 1.1, 2.1,
0.2, 1.2, 2.2
];

How would I extend A such that the contents of the new column are a list of the values in the column in B specified by YName? So, given the example show above, the desired output is:

let DesiredOutput = datatable(XName:string, YName:string, YValues:dynamic) [
"XData", "YData1", dynamic([1.0, 1.1, 1.2]),
"XData", "YData2",  dynamic([2.0, 2.1, 2.2]),
];

In essence, I'm trying to use data from A to look up an entire column of B. Is there a way of wrangling KQL to do so?


let A = datatable(XName:string, YName:string) [
"XData", "YData1",
"XData", "YData2",
];
let B = datatable(XData:double, YData1:double, YData2:double) [
0.0, 1.0, 2.0,
0.1, 1.1, 2.1,
0.2, 1.2, 2.2
];

// This doesn't work because the inner statement can't access YName, but something like this, presumably.
A
| extend YValues = toscalar(
    make_list_with_nulls(column_ifexists(YName[row_number() - 1], FallbackColumnOrSomething))
)

let DesiredOutput = datatable(XName:string, YName:string, YValues:dynamic) [
"XData", "YData1", dynamic([1.0, 1.1, 1.2]),
"XData", "YData2",  dynamic([2.0, 2.1, 2.2]),
];
// A == DesiredOutput
1

There are 1 best solutions below

1
Gyp the Cat On

You could do something like the following if your data is consistently structured enough.

let A = datatable(XName:string, YName:string) [
"XData", "YData1",
"XData", "YData2",
];
let B = datatable(XData:double, YData1:double, YData2:double) [
0.0, 1.0, 2.0,
0.1, 1.1, 2.1,
0.2, 1.2, 2.2
];
let YData1 = B
| summarize Data = make_set(YData1), YName = 'YData1';
let YData2 = B
| summarize Data = make_set(YData2), YName = 'YData2';
let BTemp = union YData1, YData2;
A
| join kind=leftouter (BTemp) on YName
| project-away *1
XName YName Data
XData YData1 [1, 1.1, 1.2]
XData YData2 [2, 2.1, 2.2]