Is it possible to iterate over the row values of a column in KQL to feed each value through a function

Question

I am applying the series_decompose_anomalies algorithm to time data coming from multiple meters. Currently, I am using the ADX dashboard feature to feed my meter identifier as a parameter into the algorithm and return my anomalies and scores as a table.

let dt = 3hr;
Table
| where meter_ID == dashboardParameter
| make-series num=avg(value) on timestamp from _startTime to _endTime step dt
| extend (anomalies,score,baseline) = series_decompose_anomalies( num, 3,-1, 'linefit')
| mv-expand timestamp, num, baseline, anomalies, score
| where anomalies ==1 
| project dashboardParameter, todatetime(timestamp), toreal(num), toint(anomalies), toreal(score)

I would like to bulk process all my meters in one go and return a table with all anomalies found across them. Is it possible to feed an array as an iterable in KQL or something similar to allow my parameter to change multiple times in a single run?

Answer 1

Simply add by meter_ID to make-series
(and remove | where meter_ID == dashboardParameter)

| make-series num=avg(value) on timestamp from _startTime to _endTime step dt by meter_ID 

P.S.
Anomaly can be positive (num > baseline => flag = 1) or negative (num < baseline => flag = -1)

Demo

let _step       = 1h;
let _endTime    = toscalar(TransformedServerMetrics | summarize max(Timestamp));
let _startTime  = _endTime - 12h;
TransformedServerMetrics
| make-series num = avg(Value) on Timestamp from _startTime to _endTime step _step by SQLMetrics
| extend (flag, score, baseline) = series_decompose_anomalies(num , 3,-1, 'linefit')
| mv-expand Timestamp to typeof(datetime), num to typeof(real), flag to typeof(int), score to typeof(real), baseline to typeof(real)
| where flag != 0 

SQLMetrics	num	Timestamp	flag	score	baseline
write_bytes	169559910.91717172	2022-06-14T15:00:30.2395884Z	-1	-3.4824039875238131	170205132.25708669
cpu_time_ms	17.369556143036036	2022-06-14T17:00:30.2395884Z	1	7.8874529842826	11.04372634506527
percent_complete	0.04595588235294118	2022-06-14T22:00:30.2395884Z	1	25.019464868749985	0.004552738927738928
blocking_session_id	-5	2022-06-14T22:00:30.2395884Z	-1	-25.019464868749971	-0.49533799533799527
pending_disk_io_count	0.0019675925925925924	2022-06-14T23:00:30.2395884Z	1	6.4686836384225685	0.00043773741690408352

Fiddle