英文:
KQL Join for Dissimilar permutations
问题
我遇到了一个问题,我想要连接两个具有不同列排列的模式,即
两个表格化的网络事件和远程URL
连接
https:/Holiday.com/page1	https://www.Health.com/page3
https://www.Health.com	https://www.gift.com/page3
www.gift.com	https://www.Holiday.com/page3
以便它们匹配域名
任何帮助将不胜感激
我已经尝试了不同的连接类型,比如:
内连接
外连接
半连接
英文:
I am having a problem where I want to join two schema with different permutations of coulmns i.e
Two tubulars Network Events and Remote URL
Join
https:/Holiday.com/page1	https://www.Health.com/page3
https://www.Health.com	https://www.gift.com/page3
www.gift.com	https://www.Holiday.com/page3
So that these match on domain
Any help would be much appreciated
I have tried diffrent join types such as:
inner
outer
semi
答案1
得分: 1
以上查询将 NetworkEvents 表中的 url 列与 RemoteURL 表中的 remoteurl 列进行匹配。
输出:
| url | remoteurl | 
|---|---|
| https://www.Health.com/page1 | www.Health.com | 
| https://www.Health.com/page3 | www.Health.com | 
| https://www.gift.com/page3 | www.gift.com | 
| https://www.facebook.com/page2 | www.facebook.com | 
查询使用 mv-apply 运算符将子查询应用于多值列的每个元素,也就是应用于 URL_list 列的每个元素,该列包含了来自 RemoteURL 表的远程URL列表。where 子句用于基于 url 列是否包含 URL_list 列中的任何远程URL来过滤 NetworkEvents 表,使用 contains 运算符。
英文:
let NetworkEvents = datatable(url:string)
[
'https://www.Health.com/page1',
'https://www.Health.com/page3',
'https://www.gift.com/page3',
'https://www.facebook.com/page2'
];
let RemoteURL = datatable(remoteurl:string)
[
'www.facebook.com',
'www.Health.com',
'www.gift.com'
];
let URL_list = toscalar(RemoteURL | summarize make_list(remoteurl));
NetworkEvents
| mv-apply remoteurl = URL_list on (where url contains remoteurl)
The above query matches the url column in the NetworkEvents table with the remoteurl column in the RemoteURL table.
Output:
| url | remoteurl | 
|---|---|
| https://www.Health.com/page1 | www.Health.com | 
| https://www.Health.com/page3 | www.Health.com | 
| https://www.gift.com/page3 | www.gift.com | 
| https://www.facebook.com/page2 | www.facebook.com | 
The query uses the  mv-apply  operator to apply a subquery to each element of a multi-value column, that is to each element of the  URL_list  column, which contains a list of remote URLs from the  RemoteURL  table. The  where  clause is used to filter the  NetworkEvents  table based on whether the  url  column contains any of the remote URLs in the  URL_list  column using the  contains  operator.
通过集体智慧和协作来改善编程学习和解决问题的方式。致力于成为全球开发者共同参与的知识库,让每个人都能够通过互相帮助和分享经验来进步。


评论