Passing column name as parameter in Kusto query

Question

I need to pass the column name dynamically into the query. While following is syntactically correct it does not really execute the condition on the particular column.

Is this even possible in Kusto?

let foo = (duration: timespan, column:string) {
    SigninLogs
    | where TimeGenerated >= ago(duration) 
    | summarize totalPerCol = count() by ['column']
};
//foo('requests')<-- does not work
//foo('user') <-- does not work
//foo('ip')<-- does not work

user_7861807 · Answer

you can try using the column_ifexists() function: https://docs.microsoft.com/en-us/azure/data-explorer/kusto/query/columnifexists.

for example:

let foo = (column_name:string) {
    datatable(col_a:string)["hello","world"]
    | summarize totalPerCol = count() by column_ifexists(column_name, "")
};
foo('col_a')

col_a	totalPerCol
hello	1
world	1

Passing column name as parameter in Kusto query

1 Answers