If <something>, do nothing in Kusto

Viewed 5653

Use case: Inside Azure Application Insights, create a table of views per page from an Azure web app

Using Kusto in Azure Application Insights, I would like to merge the rows in table 1:

enter image description here

Into table 2:

enter image description here

Unfortunately the query below replaces cells in the first column (except the first row) with the cells in the second column. This is expected based on how the query is written. Unfortunately it is incorrect and not my goal.

enter image description here

pageViews 
| where timestamp between(datetime("2020-03-01T00:00:00.000Z")..datetime("2020-06-01T00:00:00.000Z"))
| extend guide = case(
    url contains "/guide-1/","guide-1",
    url contains "/guide-2/","guide-2",
    url contains "/guide-3/","guide-3",
    "home-page"
)
| extend tag = case(
    url contains "/guide-1/","install",
    guide contains "home-page","home-page",
    "how-to"
)
| extend name = case(
    name contains "Welcome to docs","Welcome to docs",
    "home-page" //This is incorrect - nothing should happen if the name does not contain "Welcome to docs"
)
| summarize Ocurrences=count() by name, tag, guide

I have searched Microsoft documentation for a way to "do nothing" if a condition is not met but have not come up with anything, due to my lack of knowledge about Kusto. I tried iff but was not successful.

Thank you for any help, including advice if this approach is not the best.

1 Answers

If you would like to keep the 'name' under certain conditions, you can just do:

| extend name = case( name contains "Welcome to docs","Welcome to docs", name )

pageViews 
| where timestamp between(datetime("2020-03-01T00:00:00.000Z")..datetime("2020-06-01T00:00:00.000Z"))
| extend guide = case(
    url contains "/guide-1/","guide-1",
    url contains "/guide-2/","guide-2",
    url contains "/guide-3/","guide-3",
    "home-page"
)
| extend tag = case(
    url contains "/guide-1/","install",
    guide contains "home-page","home-page",
    "how-to"
)
| extend name = case(
    name contains "Welcome to docs","Welcome to docs",
    name
)
| summarize Ocurrences=count() by name, tag, guide

Also, it is better to use 'has' instead of 'contains': 'has' looks for full words and is faster than 'contains'.

Related