CODEWITHSUNDEEP
azure-data-explorerkql
John Stud
John Stud

Reputation: 1779

Kusto Query Language: How to save column of results into a variable?

Lets say I have a query like:

cluster("cluster1").database("db2").Table3
| distinct *  // distinct combinations of data
| take 5  // take 5

How do I save the values from a column in the results output to a pack_array variable. I want to use this pack_array variable for follow on queries like:

cluster("cluster2").database("db3").Table1
| where ColumnofInterest in (pack_array_var from above)
| take 5  // take 5

Upvotes: 1

Views: 4045

Answers (1)

Avnera
Avnera

Reputation: 7608

Provide the "*" argument to the function and use the "let" statement. Here is an example:

let ValuesFromTheOtherCluster = cluster('cluster1').database('db2').Table3
| extend tempArray = pack_array(*)
| summarize filters = make_set(tempArray); 
cluster('cluster2').database("db3").Table1
| where ColumnofInterest in (ValuesFromTheOtherCluster)

Upvotes: 3

Related Questions