KQL:合并同一表格的两列

huangapple go评论52阅读模式
英文:

KQL: Merge 2 column of the same table

问题

我正在尝试将同一表格的两列合并成一列。

Col1 Col2
1 4
2 5
3 6

合并为

Col3
1
2
3
4
5
6

我是一个KQL新手。我的目标是创建一个查询,提取两列的信息,将这两列合并成一列,然后进行一些字符串操作,以提取我想要的数据(从电子邮件地址中提取域名)。

我尝试过使用join、extend和summarize。

我的当前不起作用的查询如下(MS Sentinel):

let emaildomain = dynamic(['aaa', 'bbb']);
EmailEvents
| where RecipientEmailAddress in (emaildomain) or SenderFromDomain in (emaildomain)
| extend mailsaddreses = RecipientEmailAddress, SenderFromAddress
| project mailsaddreses
| project splitted = split(mailsaddreses, '@')
| project domainnames = splitted[1]
| distinct tostring(domainnames)
| where domainnames !has "myCompany"

简化后的查询如下:

let emaildomain = dynamic(['AAA.com']);
EmailEvents
| where RecipientEmailAddress in (emaildomain) or SenderFromDomain in (emaildomain)
| distinct RecipientEmailAddress, SenderFromAddress

我希望"RecipientEmailAddress"和"SenderFromAddress"在同一列中。

提前感谢您的帮助 KQL:合并同一表格的两列

英文:

I'm trying to merge 2 column of the same table into 1 column.

from

Col1 Col2
1 4
2 5
3 6

into

Col3
1
2
3
4
5
6

I'm a KQL newbie. My goal is to have a query, extract information of two column, merge the two columns into a new one and perform some string manipulation to extract the data that I want (domain names from emails addresses)

I have try with join, extend and summarize.

my current unworking query is the following (MS Sentinel):

<code>let emaildomain = dynamic(['aaa', 'bbb']);
EmailEvents
| where RecipientEmailAddress in (emaildomain) or SenderFromDomain in (emaildomain)
| extend mailsaddreses = RecipientEmailAddress, SenderFromAddress
| project mailsaddreses
| project splitted = split(mailsaddreses, '@')
| project domainnames = splitted[1]
| distinct tostring(domainnames)
| where domainnames !has "myCompany"
</code>

the simplified query is the following

<code>let emaildomain = dynamic(['AAA.com']);
EmailEvents
| where RecipientEmailAddress in (emaildomain) or SenderFromDomain in (emaildomain)
| distinct RecipientEmailAddress, SenderFromAddress</code>

where I want "RecipientEmailAddress", "SenderFromAddress" to be in the same column

Thank you in advance for your help KQL:合并同一表格的两列

答案1

得分: 1

你可以使用union运算符

例如:

let T = datatable(Col1: int, Col2: int)
[
    1, 4,
    2, 5,
    3, 6
]
;
T
| project Col3 = Col1
| union (T | project Col3 = Col2)
Col3
1
2
3
4
5
6
英文:

you can use the union operator.

for example:

let T = datatable(Col1: int, Col2: int)
[
    1, 4,
    2, 5,
    3, 6
]
;
T
| project Col3 = Col1
| union (T | project Col3 = Col2)
Col3
1
2
3
4
5
6

huangapple
  • 本文由 发表于 2023年7月14日 05:18:24
  • 转载请务必保留本文链接:https://go.coder-hub.com/76683293.html
匿名

发表评论

匿名网友

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen:

确定