英文:
KQL: Merge 2 column of the same table
问题
我正在尝试将同一表格的两列合并成一列。
从
| Col1 | Col2 | 
|---|---|
| 1 | 4 | 
| 2 | 5 | 
| 3 | 6 | 
合并为
| Col3 | 
|---|
| 1 | 
| 2 | 
| 3 | 
| 4 | 
| 5 | 
| 6 | 
我是一个KQL新手。我的目标是创建一个查询,提取两列的信息,将这两列合并成一列,然后进行一些字符串操作,以提取我想要的数据(从电子邮件地址中提取域名)。
我尝试过使用join、extend和summarize。
我的当前不起作用的查询如下(MS Sentinel):
let emaildomain = dynamic(['aaa', 'bbb']);
EmailEvents
| where RecipientEmailAddress in (emaildomain) or SenderFromDomain in (emaildomain)
| extend mailsaddreses = RecipientEmailAddress, SenderFromAddress
| project mailsaddreses
| project splitted = split(mailsaddreses, '@')
| project domainnames = splitted[1]
| distinct tostring(domainnames)
| where domainnames !has "myCompany"
简化后的查询如下:
let emaildomain = dynamic(['AAA.com']);
EmailEvents
| where RecipientEmailAddress in (emaildomain) or SenderFromDomain in (emaildomain)
| distinct RecipientEmailAddress, SenderFromAddress
我希望"RecipientEmailAddress"和"SenderFromAddress"在同一列中。
提前感谢您的帮助 ![]()
英文:
I'm trying to merge 2 column of the same table into 1 column.
from
| Col1 | Col2 | 
|---|---|
| 1 | 4 | 
| 2 | 5 | 
| 3 | 6 | 
into
| Col3 | 
|---|
| 1 | 
| 2 | 
| 3 | 
| 4 | 
| 5 | 
| 6 | 
I'm a KQL newbie. My goal is to have a query, extract information of two column, merge the two columns into a new one and perform some string manipulation to extract the data that I want (domain names from emails addresses)
I have try with join, extend and summarize.
my current unworking query is the following (MS Sentinel):
<code>let emaildomain = dynamic(['aaa', 'bbb']);
EmailEvents
| where RecipientEmailAddress in (emaildomain) or SenderFromDomain in (emaildomain)
| extend mailsaddreses = RecipientEmailAddress, SenderFromAddress
| project mailsaddreses
| project splitted = split(mailsaddreses, '@')
| project domainnames = splitted[1]
| distinct tostring(domainnames)
| where domainnames !has "myCompany"
</code>
the simplified query is the following
<code>let emaildomain = dynamic(['AAA.com']);
EmailEvents
| where RecipientEmailAddress in (emaildomain) or SenderFromDomain in (emaildomain)
| distinct RecipientEmailAddress, SenderFromAddress</code>
where I want "RecipientEmailAddress", "SenderFromAddress" to be in the same column
Thank you in advance for your help ![]()
答案1
得分: 1
你可以使用union运算符。
例如:
let T = datatable(Col1: int, Col2: int)
[
    1, 4,
    2, 5,
    3, 6
]
;
T
| project Col3 = Col1
| union (T | project Col3 = Col2)
| Col3 | 
|---|
| 1 | 
| 2 | 
| 3 | 
| 4 | 
| 5 | 
| 6 | 
英文:
you can use the union operator.
for example:
let T = datatable(Col1: int, Col2: int)
[
    1, 4,
    2, 5,
    3, 6
]
;
T
| project Col3 = Col1
| union (T | project Col3 = Col2)
| Col3 | 
|---|
| 1 | 
| 2 | 
| 3 | 
| 4 | 
| 5 | 
| 6 | 
通过集体智慧和协作来改善编程学习和解决问题的方式。致力于成为全球开发者共同参与的知识库,让每个人都能够通过互相帮助和分享经验来进步。


评论