CODEWITHSUNDEEP
kql
Gary
Gary

Reputation: 141

Compare two arrays of strings - KQL

We are trying to compare two arrays of strings and matching keywords/domains from the first array (url1) with url2. Can we use a wild card or alternate way to match keywords/domains in url1 with the whole strings in url2?

Sample Query: let url1 = dynamic(["test2.com","test4.com"]); let url2 = dynamic( ["test.com", "test2.com/1234/", "test3.com"]); print result = set_difference(url2,url1)

Current Results: ["test.com","test2.com/1234/","test3.com"]

Expected Results: ["test.com","test3.com"]

Upvotes: 0

Views: 1064

Answers (1)

David דודו Markovitz
David דודו Markovitz

Reputation: 44951

let url1 = dynamic(["test2.com","test4.com"]);
let url2 = dynamic( ["test.com", "test2.com/1234/", "test3.com"]); 
let url2_clean = toscalar(print url = url2 | mv-apply url to typeof(string) on (summarize make_list(trim_end("/.*", url))));
print result = set_difference(url2_clean, url1)
result
["test.com","test3.com"]

Fiddle

In case you need it on a row-level:

print url1 = dynamic(["test2.com","test4.com"]), url2 = dynamic( ["test.com", "test2.com/1234/", "test3.com"])
| mv-apply url2 to typeof(string) on (summarize url2_clean = make_list(trim_end("/.*", url2)))
| project result = set_difference(url2_clean, url1)
result
["test.com","test3.com"]

Fiddle

Upvotes: 2

Related Questions