I want to combine 2 result set into one.
Requirement: I am working on "Workbook" in azure and trying to add a drop-down as a parameter.I need to add values in the drop down using query. I retrieved the running apps
from below query. I need to add custom value to the result set.
Table 1: (Holds all the Function Apps running)
let AvailableApps = customEvents
| summarize by operation_Name
| order by operation_Name asc;
I need to combine one value to the above result set ie: "All Apps" .
How can we achieve it. I tried altering below code to suit mine,
let Range10 = view () { range MyColumn from 1 to 10 step 1 };
Can anyone shed some light on this.
Sorry if this is a duplicate question.
Edited: I figured out one way, Let me know if this is the best approach.
let AvailableApps = customEvents
| summarize by operation_Name
| order by operation_Name asc;
let DefaultValue = datatable (operation_Name:string)
["All Apps"];
union DefaultValue,AvailableApps;
When dealing with Drop Down parameters you can add an "All" choice from within the workbook UI that will be appended to the result set of the kusto query. For example:
See the docs for more info.
Related
Good morning,
I am trying to run a kusto Query to display unique owner tags to show in a chart the amount of times an owner shows up in azure. I want to have all the distinct owners and cost centers show up but am having trouble figuring out the best way to do that.Below is an example but I need to specify multiple owners to produce a chart that shows all the unique owners in Azure
resources
| where tags['owner'] =~ "Billy"
| summarize count()
This should give you a direction. You'll need to do something similar for the "cost center" property (or update your question to elaborate on which part of your data set it comes from)
resources
| extend owner = tostring(tags.owner)
| summarize count() by owner
| render barchart // you can choose a different type of chart
given your modified description: If I have two sets of tags one that is (Owner) and the other is (owner) how would I combine them together in the query? -> you could do this (assuming you can't fixed the source data, which would be better):
union (
resources
| extend owner = tostring(tags.owner) // lowercase 'o' in 'tags.owner'
| summarize count() by owner
), (
resources
| extend owner = tostring(tags.Owner) // uppercase 'O' in 'tags.Owner'
| summarize count() by owner
)
| summarize sum(count_) by owner
I am very new to kql, and i am stuck on this query. I am looking to have query display which users have had sign-ins from different states. I created this query, but i do not know how to count the results in the column "names".
SigninLogs
| project tostring(LocationDetails.state), UserDisplayName
| extend p =pack( 'Locations', LocationDetails_state)
| summarize names = make_set(p) by UserDisplayName
This generates a column "names" with a row like so:
[{"Locations":"Arkansas"},{"Locations":"Iowa"},{"Locations":""}]
Here is a simple query that grabs all sign-ins from users and another column with the locations.
SigninLogs
| where ResultType == "0"
| summarize by UserDisplayName, tostring(LocationDetails.state)
Is there a way to combine the duplicates of users column, and then display each location in the second? If so, could i count each location in order to filter by where location is > 1?
I am looking to have query display which users have had sign-ins from different states
Assuming I understood your question correctly, this could work (using array_length()):
SigninLogs
| project State = tostring(LocationDetails.state), UserDisplayName
| summarize States = make_set(State) by UserDisplayName
| where array_length(States) > 1 // filter users who had sign-ins from *more than 1 state*
In T-SQL, when grouping results, you can also get a running total row when specifying "WITH ROLLUP".
How can i achieve this in Kusto? So, consider the following query:
customEvents | summarize counter = count() by name
The query above gives me a list of event names, and how often they occurred. This is what i need, but i also want a row with the running total (the count of all events).
It feels like there should be an easy way to achieve this, but i havent found anything in the docs ...
You can write 2 queries, the first query is used to count the number of each events, the second query is used to count the numbers of all the events. Then use the union operator to join them.
The query like below:
customEvents
| count
| extend name = "total",counter=Count
| project name,counter
| union
(customEvents
| summarize counter = count() by name)
Test result is as below:
I'm looking to try do the following;
I want to have say 3 columns.
Transaction | Category | Amount
so I want to be able to enter a certain Name in Transaction say for argument sake "Tesco" then have a returned result in Category Column say "Groceries" and I can enter a specific amount then myself in Amount Colum.
Thing is I will need to have unlimited or quite a lot of different Transactions and have them all in pre determined Categories so that each time when I type in a Transaction it will automatically display the category for me.
All help much appreciated.
I know a simple If Statement wont suffice I can get it to work no problem using a Simple IF Statement but as each Transaction is different I don't know how to program further.
Thanks.
Colin
Use a lookup table. Let's say it's on a sheet called "Categories" and it looks like this:
| A | B
1 | Name | Category
2 | Tesco | Groceries
3 | Shell | Fuel
Then, in the table you describe, use =VLOOKUP(A2, Categories!$A$2:$B$3, 2, FALSE) in your "Category" field, assuming it's in B2.
I do this a fair bit using Data Validation and tables.
In this case I would have two tables containing my pick lists on a lookup sheet.
Transaction Table : [Name] = "loTrans" - with just the list of transactions sorted
Category Table : [Name] = "loCategory" - two columns in table, sorted by Both columns - Trans and Category
Header1 : Transactions
Header2 : Category
The Details Table:
the transaction field will have a simple data validation, using a
named range "trans", that selects from the table loTrans.
the transaction field will also use data validation, using a named
range, but the source of the named range ("selCat" will be a little more
complex. It will be something like:
=OFFSET(loCategory[Trans],MATCH(Enter_Details!A3,loCategory[Trans],0)-1,1,COUNTIF(loCategory[Trans],Enter_Details!A3),1)
As you enter details, and select different Transactions, the data validation will be limited to the Categorys of your selected transactions
An example file
All I've done a lot of background reading on this on and off for the past day or so and I'm none the wiser on how to achieve this.
I have looked on this site and found ways of concatenating multiple rows into one column however what I'm after is a bit more bespoke, please help...
I have two tables - one is a list of people and details about them such as name etc and a person reference.
The second contains a number of alerts about a person, one person can have multiple alerts. This would contain a person reference and the type of alert they have in a string.
I want to join these two tables using an inner join on the person reference.
I next want to find all of the alerts for each person and concatenate it into a string and show this as the "All alerts" column.
So I will end up with the following output:
First Name | Surname | All Alerts
-----------+---------+--------------------------
Tony | Stark | Alert 1, Alert 2, Alert 3
I can get as far as going through all of the alerts in the alerts table and put the alerts for every person into a string, obviously I need a concatenated value for each person, and haven't figured out how to do this.
I've spent a day on this and looked into XMLPath solutions and using CTE, CROSS APPLY and subqueries to specify the where clause. I am a little lost.
DECLARE #ConcatenatedVals VARCHAR (255)
SET #ConcatenatedVals =
(
DECLARE #AllAlerts VARCHAR(8000)
SELECT #AllAlerts = COALESCE(#AllAlerts + ', ', '') + personAlert
FROM Alerts
SELECT #AllAlerts AS 'All Alerts'
)
I found the solution for this posted here:
https://www.simple-talk.com/sql/t-sql-programming/concatenating-row-values-in-transact-sql/#Toc205129480
This referenced a solution by Adam Machanic
Also, stuff is actually a function, not seen this before:
SELECT p1.CategoryId,
stuff( (SELECT ','+ProductName
FROM Northwind.dbo.Products p2
WHERE p2.CategoryId = p1.CategoryId
ORDER BY ProductName
FOR XML PATH(''), TYPE).value('.', 'varchar(max)')
,1,1,'')
AS Products
FROM Northwind.dbo.Products p1
GROUP BY CategoryId ;