Kusto query for iterate string array with filtering

Question

Now I have data, like CSVs = "[email protected],[email protected],[email protected],[email protected],[email protected],[email protected]"
apply parse_csv(), then get

| data                                                                                       |
| ["[email protected]", "[email protected]", "[email protected]", "[email protected]", "[email protected]", "[email protected]"] |

How can I simply filter the data to get

| XXX.com               | YYY.com        | ZZZ.com  |
|-----------------------|----------------|----------|
| ["AAA", "CCC", "FFF"] | ["BBB", "EEE"] | ["DDD"]  |

Key is not how to transform data ([email protected] -> AAA), but how to split date for each type （XXX.com, YYY.com, ZZZ.com）.

Yoni L. · Accepted Answer · 2021-12-06 20:21:14Z

1

This could work, though not too efficiently.

Consider adjusting how you consume the data, in terms of output schema, so that you'd be able to remove the last 2 rows:

print input = "[email protected],[email protected],[email protected],[email protected],[email protected],[email protected]"
| mv-apply address = split(input, ",") on (
    parse address with name "@" domain
    | summarize make_list(name) by domain
)
| summarize b = make_bag(pack(domain, list_name))
| evaluate bag_unpack(b)

XXX.com	YYY.com	ZZZ.com
[ "AAA", "CCC", "FFF" ]	[ "BBB", "EEE" ]	[ "DDD" ]

answered Dec 6, 2021 at 20:21

Yoni L.

26.5k3 gold badges46 silver badges63 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Kusto query for iterate string array with filtering

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related