KQL help. Calling a function and returning a value from datatable

Question

Can someone advise on the best approach with this question please.

I have some data in Application Insights logs. I am pulling back a number of items - one of which is an ID field. I would like to convert this ID field into a 'friendly name'.

For example: ex1579 will mean nothing (but this is what is in my data). Instead ex1579 = Microsoft, and ex1580 = IBM. (I have hundreds of these).

I have created a function - that looks like this: (I am not sure if I am attacking this the best way)

let exMapping = datatable(id: string, company: string)[ "ex1579", 'Microsoft', "ex1580", "IBM" ]

In my kql and I have many - I don't want to have to individually create CASE statements (which I know will work) - as this data will continually change....and as opposed to updating multiple KQLs - I just want to maintain one datatable.

Going back to my KQL now - when I am returning ex1579 or ex1580 for example; instead of returning these values; I want to instead return (in this case) - Microsoft and IBM.

Can anyone advise?

David דודו Markovitz · Answer

You can use a dictionary

Unlike Log Analytics, it seems that Application Insights doesn't currently supports function's parameters, so our function will return the entire dictionary and we will pick a specific key as part of our query.

This would be the function definition:

dynamic({"ex1579":'Microsoft', "ex1580":"IBM"})

This is how it can be used:

print id = "ex1579"
| extend company = getCompany()[id]

KQL help. Calling a function and returning a value from datatable

1 Answers