时间戳

首页 > 解决方案 > 替换 Kusto 中给定键的值

azure - 替换 Kusto 中给定键的值

问题描述

我正在尝试使用.set-or-replace命令将下面的“主题”条目从示例/消耗/备份修改为示例/消耗/备份，但我对 Kusto 的世界没有太多了解。

我似乎无法引用记录、数据中的子标题。

    "source_": CustomEventRawRecords,
"Records": [
{
                "metadataVersion": "1",
                "dataVersion": "",
                "eventType": "consumptionRecorded",
                "eventTime": "1970-01-01T00:00:00.0000000Z",
                "subject": "sample/consumption/backups",
                "topic": "/subscriptions/1234567890id/resourceGroups/rg/providers/Microsoft.EventGrid/topics/webhook",
                "data": {
                        "resourceId": "/subscriptions/1234567890id/resourceGroups/RG/providers/Microsoft.Compute/virtualMachines/vm"
                        }, 
                        "id": "1234567890id"
}
],

命令我已经开始工作了；

.set-or-replace [async] CustomEventRawRecords [with (subject = sample/consumption/backup [, ...])] <| QueryOrCommand

标签： azureazure-data-explorer

解决方案

如果您已经在处理数据，为什么不将其转换为柱状表示呢？这样您就可以轻松地进行您想要进行的更正，并获得表格运算符的全部丰富性以及有助于您轻松制定查询的智能感知体验

这是一个示例查询，它将执行此操作：

在浏览器中执行查询

datatable (x: dynamic)[dynamic({"source_": "CustomEventRawRecords",
"Records": [
{
"metadataVersion": "1",
"dataVersion": "",
"eventType": "consumptionRecorded",
"eventTime": "1970-01-01T00:00:00.0000000Z",
"subject": "sample/consumption/backups",
"topic": "/subscriptions/1234567890id/resourceGroups/rg/providers/Microsoft.EventGrid/topics/webhook",
"data": {
"resourceId": "/subscriptions/1234567890id/resourceGroups/RG/providers/Microsoft.Compute/virtualMachines/vm"
}, 
"id": "1234567890id"
}
]})]
| extend records = x.Records
| mv-expand record=records
| extend subject = tostring(record.subject)
| extend  subject = iff(subject == "sample/consumption/backups", "sample/consumption/backup", subject)
| extend metadataVersion = tostring(record.metadataVersion)
| extend dataVersion = tostring(record.dataVersion)
| extend eventType = tostring(record.eventType)
| extend topic= tostring(record.topic)
| extend data = record.data
| extend id = tostring(record.id)
| project-away  x, records, record

推荐阅读