This question already has answers here:
Wildcard search in cassandra database
(2 answers)
Closed 8 years ago.
I have a table and data as shown below, I want to query records containing owner. Any help please ?
select name from team where blob like %owner%
CREATE TABLE ipl.team(
name text,
captain text,
blob text,
PRIMARY KEY (name, captain)
)
name | captain | blob
------------+-------------------+----------------------------------------
KKR | SRK | {'owner': 'ABC', 'win': '10'}
DD | ME | {'owner': 'XYZ', 'win': '8'}
Although I'm hoping you are not really storing JSON in a text field (it's a bit of a waste), I will try to answer.
In short, no, it does not. It is a key/value store, although with a more complicated storage model than, for example, Riak.
If you want to do something like that, you should implement a text search engine like elastic search, which is a separate topic altogether. You might want to check this quesiton: Elasticsearch vs Cassandra vs Elasticsearch with Cassandra
Related
I am using Windows Update for Business to pull in InTune data to track patching for my org. This data is stored in a Log Analytics Workspace and can be queried using KQL.
I am trying to write a specific KQL query that shows two categories with nested dropdowns.
Ideal Format for output of this query
The current query I have built is:
let _SnapshotTime = datetime(2023-01-18T06:00:00Z);
UCClientUpdateStatus
| where TimeGenerated == _SnapshotTime
| join (UCClient | where TimeGenerated == _SnapshotTime) on DeviceName
| summarize arg_max(TimeGenerated, *) by OSSecurityUpdateStatus, TargetKBNumber, DeviceName
This returns too much data and is not quite structured the way I'm looking for. Has anyone here had any luck with creating a KQL query that returns Intune patching data status in a format similar to above?
This question already has an answer here:
How to use SQL Query with hyphen in Collection name?
(1 answer)
Closed last year.
In my database I have a container named "freedom-fighters".
Doing SELECT * FROM [freedom-fighters] does not work. Neither does SELECT * FROM "freedom-fighters", nor SELECT * FROM ["freedom-fighters"], nor anything else I have tried.
I am working in the web gui.
When you query via Core/SQL API, you don't need to specify the exact collection name. In the Portal you can use a simple alias to query. For example,
SELECT * FROM c
Cosmos DB will know which one you are targeting already and c will be something like an alias.
I have an issue with showing specific resources with azure kusto query.
what i want is to write a kusto query that show only database resources and server resources in azure.
i have written following query regarding Databases:
resources
| where type in ("microsoft.sql/servers/databases","microsoft.dbforpostgresql/servers","microsoft.azuredata/postgresinstances","microsoft.dbformariadb/servers","microsoft.dbformysql/flexibleservers","microsoft.dbformysql/servers","microsoft.dbforpostgresql/flexibleservers","microsoft.dbforpostgresql/servergroups","microsoft.kusto/clusters/databases","microsoft.sql/managedinstances/databases","microsoft.synapse/workspaces/sqldatabases","ravenhq.db/databases","microsoft.documentdb/databaseaccounts")
| summarize Amount=count() by type
But when i execute the query it shows me two Databases even though i only have create one, the extra one is a "master" which should not be included because there is only one resource in the resource group
i have also tried with the following query:
resources
| where type contains "database" | distinct type
| summarize Amount=count() by type
But then the issue is that it doesnt include all the db's that doesnt have the word "database" in the type name for example "microsoft.azuredata/postgresinstances"
so the question is, how do i write a query that shows ALL the databases on my dashboard.
The second part of the question which is similar to the previous with databases is how i show all the Servers.
I have tried with the following queries:
resources
| where split(type,"/")[array_length(split(type,"/"))] contains "servers"
it gave me no result even though i had a server.
then i tried:
resources
| where type contains "/server" | distinct type
| summarize Amount=count() by type
that didnt work because it also returned all the database resources cuntaining the work "server"
i have tried to look through microsofts documentation, but cannot figure out what to do.
If you don't want the master databases (which are the databases that store system level data in SQL databases, you can simply filter them out:
resources
| where type in ("microsoft.sql/servers/databases","microsoft.dbforpostgresql/servers","microsoft.azuredata/postgresinstances","microsoft.dbformariadb/servers","microsoft.dbformysql/flexibleservers","microsoft.dbformysql/servers","microsoft.dbforpostgresql/flexibleservers","microsoft.dbforpostgresql/servergroups","microsoft.kusto/clusters/databases","microsoft.sql/managedinstances/databases","microsoft.synapse/workspaces/sqldatabases","ravenhq.db/databases","microsoft.documentdb/databaseaccounts")
| where name type != "microsoft.sql/servers/databases" or name != "master"
| summarize Amount=count() by type
Regarding the 2nd question, this should work since the has operator will only match whole tokens (and a slash separates tokens):
resources | where type has "servers"
I am trying to understand Kusto (Log Analytics Query Language in Azure).
According to the documentation;
To retrieve , project name and resultsCode from the dependencies table, I need to enter the following:
dependencies
| project name, resultCode
The machines I have subscribed to do not have this table.
I am using the heartbeat table and trying to retrieve computer and category like so:
Heartbeat
| Category, Computer , IsGatewayInstalled
I however get the following error:
Query could not be parsed at 'Category' on line [2,2]
Token: Category Line: 2 Position: 2
This seems trivial and will appreciate any pointers on this.
the error you're getting is due to the fact there's no valid operator after the pipe (|), you should use the project operator before specifying the column names you want to retrieve
is there a way to perform a select based on a string prefix using CQL3?
For example, consider the following table:
Key | Value
------------
ABC | 0x01
ABD | 0x02
BBB | 0x03
I want to select all the keys with the prefix 'AB'.
The database will be used to store spacial information, using a geohash approach.
That is not possible "out of the box"... However, there are some "tricks" people came up with, see these two posts:
Cassandra (Pycassa/CQL) Return Partial Match
Is there any query for Cassandra as same as SQL:LIKE Condition?
...another (somehow similar) approach could be to define "composite key", where you define some prefixes as "partition key", e.g.: {key1,key2}, where key1 = ABand key2 = ABC... in these situations you could query by "key1" only and get a set of rows (like you want to do), or by "key1" and "key2" (in case you want a specific entry). You can also query only by "key2" (if you add "allow filtering" to your "select" query, however this can lead to "problems" if you have too many rows). Not sure if you can do this with your data...
HTH.
Not built-in in C* but possible with cassandra-lucene-index C* plugin. You can create a lucene index on the column and search the text using prefix search.
UPDATE: Since v3.4 Cassandra introduced SASI indices that offer the required functionality.