CODEWITHSUNDEEP
azure-data-explorerkql
ajmore
ajmore

Reputation: 59

how to create a new table having json record from a kusto table

We receive a multiline json (in format below), and we store them into a Kusto table "OldT" after using multiline json mapping.

{"severity":"0","hostname":"Test.login","sender":"Test.login","body":"2a09dfa1","facility":"1","version":"1","timestamp":"2020-04-23T07:07:06.077963Z"}
{"severity":"0","hostname":"Test.login","sender":"Test.login","body":"2a09dfa1","facility":"1","version":"1","timestamp":"2020-04-23T07:07:00.893151Z"}

Records in table "OldT":

sender      timestamp                   severity    version body    priority    facility    hostname

Test.login  2020-04-23T07:07:06.077963  0           2a09dfa1        1     Test.login
Test.login  2020-04-23T07:07:00.893151Z 0           2a09dfa1        1     Test.login

Now I need to move the data into another table, say "NewT" with only one column, say "Rawrecord"

Rawrecord:

{"severity":"0","hostname":"Test.login","sender":"Test.login","body":"2a09dfa1","facility":"1","version":"1","timestamp":"2020-04-23T07:07:06.077963Z"}
{"severity":"0","hostname":"Test.login","sender":"Test.login","body":"2a09dfa1","facility":"1","version":"1","timestamp":"2020-04-23T07:07:00.893151Z"}

How can I move this data to NewT?

Upvotes: 2

Views: 580

Answers (1)

Avnera
Avnera

Reputation: 7608

You can use the pack_all() function. For example:

OldT | project Rawrecord = pack_all()

To move it to another table you can use the .set-or-append command for example:

.set-or-append NewT <| OldT | project Rawrecord = pack_all()

Upvotes: 3

Related Questions