How to build a new dynamic column based on other columns in Azure Data Explorer KQL

user_9284962 0
Viewed 621

I have a result set with various dynamic columns and want to project those dynamic columns to a new dynamic column where those columns are contained as properties.

Example:

My Result set consists of 2 dynamic columns

"MainSoftware": {
    "Version": "2.10",
    "BuildConfig": 3,
    "SettingsVersion": 1
},
"SecSoftware": {
    "ArticleNumber": "123",
    "Version": "1.0"
}

i want to create following column as output:

"Software": {
  "MainSoftware": {
    "Version": "2.10",
    "BuildConfig": 3,
    "SettingsVersion": 1
  },
  "SecSoftware": {
    "ArticleNumber": "123",
    "Version": "1.0"
  }
}

i tried using make_bag but this can only be used as an aggregate function and i have a flat result set in my case where i only need to build a computed dynamic column based on columns i already have.

i also tried to create the column using the dynamic keyword like this

| extend Software=dynamic({"MainSoftware": MainSoftware, "SecSoftware":SecSoftware})

but this isn't syntactically correct as it appears i can only use constant values in the expression.

kql azure-data-explorer
1 Answers

I found a solution to the problem.

The pack-function does exactly what i need.

| project Software=pack("MainSoftware", MainSoftware, "SecSoftware", SecSoftware)
user_92849620
Related