KQL Join for Dissimilar permutations 可以翻译为 “KQL 不同排列的连接”。

huangapple go评论64阅读模式
英文:

KQL Join for Dissimilar permutations

问题

我遇到了一个问题,我想要连接两个具有不同列排列的模式,即

两个表格化的网络事件和远程URL
连接

https:/Holiday.com/page1	https://www.Health.com/page3
https://www.Health.com	https://www.gift.com/page3
www.gift.com	https://www.Holiday.com/page3

以便它们匹配域名

任何帮助将不胜感激

我已经尝试了不同的连接类型,比如:

内连接
外连接
半连接

英文:

I am having a problem where I want to join two schema with different permutations of coulmns i.e

Two tubulars Network Events and Remote URL
Join

https:/Holiday.com/page1	https://www.Health.com/page3
https://www.Health.com	https://www.gift.com/page3
www.gift.com	https://www.Holiday.com/page3

So that these match on domain

Any help would be much appreciated

I have tried diffrent join types such as:

inner
outer
semi

答案1

得分: 1

以上查询将 NetworkEvents 表中的 url 列与 RemoteURL 表中的 remoteurl 列进行匹配。

输出

url remoteurl
https://www.Health.com/page1 www.Health.com
https://www.Health.com/page3 www.Health.com
https://www.gift.com/page3 www.gift.com
https://www.facebook.com/page2 www.facebook.com

查询使用 mv-apply 运算符将子查询应用于多值列的每个元素,也就是应用于 URL_list 列的每个元素,该列包含了来自 RemoteURL 表的远程URL列表。where 子句用于基于 url 列是否包含 URL_list 列中的任何远程URL来过滤 NetworkEvents 表,使用 contains 运算符。

英文:
let NetworkEvents = datatable(url:string)
[
'https://www.Health.com/page1',
'https://www.Health.com/page3',
'https://www.gift.com/page3',
'https://www.facebook.com/page2'
];
let RemoteURL = datatable(remoteurl:string)
[
'www.facebook.com',
'www.Health.com',
'www.gift.com'
];
let URL_list = toscalar(RemoteURL | summarize make_list(remoteurl));
NetworkEvents
| mv-apply remoteurl = URL_list on (where url contains remoteurl)

The above query matches the url column in the NetworkEvents table with the remoteurl column in the RemoteURL table.

Output:

url remoteurl
https://www.Health.com/page1 www.Health.com
https://www.Health.com/page3 www.Health.com
https://www.gift.com/page3 www.gift.com
https://www.facebook.com/page2 www.facebook.com

The query uses the mv-apply operator to apply a subquery to each element of a multi-value column, that is to each element of the URL_list column, which contains a list of remote URLs from the RemoteURL table. The where clause is used to filter the NetworkEvents table based on whether the url column contains any of the remote URLs in the URL_list column using the contains operator.

huangapple
  • 本文由 发表于 2023年6月8日 18:26:27
  • 转载请务必保留本文链接:https://go.coder-hub.com/76430913.html
匿名

发表评论

匿名网友

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen:

确定