英文:
KQL: Merge 2 column of the same table
问题
我正在尝试将同一表格的两列合并成一列。
从
Col1 | Col2 |
---|---|
1 | 4 |
2 | 5 |
3 | 6 |
合并为
Col3 |
---|
1 |
2 |
3 |
4 |
5 |
6 |
我是一个KQL新手。我的目标是创建一个查询,提取两列的信息,将这两列合并成一列,然后进行一些字符串操作,以提取我想要的数据(从电子邮件地址中提取域名)。
我尝试过使用join、extend和summarize。
我的当前不起作用的查询如下(MS Sentinel):
let emaildomain = dynamic(['aaa', 'bbb']);
EmailEvents
| where RecipientEmailAddress in (emaildomain) or SenderFromDomain in (emaildomain)
| extend mailsaddreses = RecipientEmailAddress, SenderFromAddress
| project mailsaddreses
| project splitted = split(mailsaddreses, '@')
| project domainnames = splitted[1]
| distinct tostring(domainnames)
| where domainnames !has "myCompany"
简化后的查询如下:
let emaildomain = dynamic(['AAA.com']);
EmailEvents
| where RecipientEmailAddress in (emaildomain) or SenderFromDomain in (emaildomain)
| distinct RecipientEmailAddress, SenderFromAddress
我希望"RecipientEmailAddress"和"SenderFromAddress"在同一列中。
提前感谢您的帮助
英文:
I'm trying to merge 2 column of the same table into 1 column.
from
Col1 | Col2 |
---|---|
1 | 4 |
2 | 5 |
3 | 6 |
into
Col3 |
---|
1 |
2 |
3 |
4 |
5 |
6 |
I'm a KQL newbie. My goal is to have a query, extract information of two column, merge the two columns into a new one and perform some string manipulation to extract the data that I want (domain names from emails addresses)
I have try with join, extend and summarize.
my current unworking query is the following (MS Sentinel):
<code>let emaildomain = dynamic(['aaa', 'bbb']);
EmailEvents
| where RecipientEmailAddress in (emaildomain) or SenderFromDomain in (emaildomain)
| extend mailsaddreses = RecipientEmailAddress, SenderFromAddress
| project mailsaddreses
| project splitted = split(mailsaddreses, '@')
| project domainnames = splitted[1]
| distinct tostring(domainnames)
| where domainnames !has "myCompany"
</code>
the simplified query is the following
<code>let emaildomain = dynamic(['AAA.com']);
EmailEvents
| where RecipientEmailAddress in (emaildomain) or SenderFromDomain in (emaildomain)
| distinct RecipientEmailAddress, SenderFromAddress</code>
where I want "RecipientEmailAddress", "SenderFromAddress" to be in the same column
Thank you in advance for your help
答案1
得分: 1
你可以使用union
运算符。
例如:
let T = datatable(Col1: int, Col2: int)
[
1, 4,
2, 5,
3, 6
]
;
T
| project Col3 = Col1
| union (T | project Col3 = Col2)
Col3 |
---|
1 |
2 |
3 |
4 |
5 |
6 |
英文:
you can use the union
operator.
for example:
let T = datatable(Col1: int, Col2: int)
[
1, 4,
2, 5,
3, 6
]
;
T
| project Col3 = Col1
| union (T | project Col3 = Col2)
Col3 |
---|
1 |
2 |
3 |
4 |
5 |
6 |
通过集体智慧和协作来改善编程学习和解决问题的方式。致力于成为全球开发者共同参与的知识库,让每个人都能够通过互相帮助和分享经验来进步。
评论