英文:
KQL Join for Dissimilar permutations
问题
我遇到了一个问题,我想要连接两个具有不同列排列的模式,即
两个表格化的网络事件和远程URL
连接
https:/Holiday.com/page1 https://www.Health.com/page3
https://www.Health.com https://www.gift.com/page3
www.gift.com https://www.Holiday.com/page3
以便它们匹配域名
任何帮助将不胜感激
我已经尝试了不同的连接类型,比如:
内连接
外连接
半连接
英文:
I am having a problem where I want to join two schema with different permutations of coulmns i.e
Two tubulars Network Events and Remote URL
Join
https:/Holiday.com/page1 https://www.Health.com/page3
https://www.Health.com https://www.gift.com/page3
www.gift.com https://www.Holiday.com/page3
So that these match on domain
Any help would be much appreciated
I have tried diffrent join types such as:
inner
outer
semi
答案1
得分: 1
以上查询将 NetworkEvents
表中的 url
列与 RemoteURL
表中的 remoteurl
列进行匹配。
输出:
url | remoteurl |
---|---|
https://www.Health.com/page1 | www.Health.com |
https://www.Health.com/page3 | www.Health.com |
https://www.gift.com/page3 | www.gift.com |
https://www.facebook.com/page2 | www.facebook.com |
查询使用 mv-apply
运算符将子查询应用于多值列的每个元素,也就是应用于 URL_list
列的每个元素,该列包含了来自 RemoteURL
表的远程URL列表。where
子句用于基于 url
列是否包含 URL_list
列中的任何远程URL来过滤 NetworkEvents
表,使用 contains
运算符。
英文:
let NetworkEvents = datatable(url:string)
[
'https://www.Health.com/page1',
'https://www.Health.com/page3',
'https://www.gift.com/page3',
'https://www.facebook.com/page2'
];
let RemoteURL = datatable(remoteurl:string)
[
'www.facebook.com',
'www.Health.com',
'www.gift.com'
];
let URL_list = toscalar(RemoteURL | summarize make_list(remoteurl));
NetworkEvents
| mv-apply remoteurl = URL_list on (where url contains remoteurl)
The above query matches the url
column in the NetworkEvents
table with the remoteurl
column in the RemoteURL
table.
Output:
url | remoteurl |
---|---|
https://www.Health.com/page1 | www.Health.com |
https://www.Health.com/page3 | www.Health.com |
https://www.gift.com/page3 | www.gift.com |
https://www.facebook.com/page2 | www.facebook.com |
The query uses the mv-apply
operator to apply a subquery to each element of a multi-value column, that is to each element of the URL_list
column, which contains a list of remote URLs from the RemoteURL
table. The where
clause is used to filter the NetworkEvents
table based on whether the url
column contains any of the remote URLs in the URL_list
column using the contains
operator.
通过集体智慧和协作来改善编程学习和解决问题的方式。致力于成为全球开发者共同参与的知识库,让每个人都能够通过互相帮助和分享经验来进步。
评论