CODEWITHSUNDEEP
azure-data-explorerkql
mohit garg
mohit garg

Reputation: 75

Parse data in Kusto

I am trying to parse the below data in Kusto. Need help.

[[ObjectCount][LinkCount][DurationInUs]]
[ChangeEnumeration][[88][9][346194]]
[ModifyTargetInLive][[3][6][595903]]

Need generic implementation without any hardcoding.

Upvotes: 0

Views: 967

Answers (1)

Yoni L.
Yoni L.

Reputation: 25895

ideally - you'd be able to change the component that produces source data in that format to use a standard format (e.g. CSV, Json, etc.) instead.

The following could work, but you should consider it very inefficient

let T = datatable(s:string)
[
    '[[ObjectCount][LinkCount][DurationInUs]]',
    '[ChangeEnumeration][[88][9][346194]]',
    '[ModifyTargetInLive][[3][6][595903]]',
];
let keys = toscalar(
    T
    | where s startswith "[["
    | take 1
    | project extract_all(@'\[([^\[\]]+)\]', s)
);
T
| where s !startswith "[["
| project values = extract_all(@'\[([^\[\]]+)\]', s)
| mv-apply with_itemindex = i keys on (
    extend Category = tostring(values[0]), p = pack(tostring(keys[i]), values[i + 1])
    | summarize b = make_bag(p) by Category
)
| project-away values
| evaluate bag_unpack(b)

--->

| Category           | ObjectCount | LinkCount | DurationInUs |
|--------------------|-------------|-----------|--------------|
| ChangeEnumeration  | 88          | 9         | 346194       |
| ModifyTargetInLive | 3           | 6         | 595903       |

Upvotes: 1

Related Questions