Forum Discussion

Copper Contributor

Aug 16, 2019

Summarize dynamic array?

Hi, I apologize for my lack of experience, however this is literally my first time using / learning about Azure Data Explorer. I have this data: | project Data1 = Data[0], Data2 = Data[1],...

Azure Data Explorer (Kusto)

Kusto language

bphillips09

Copper Contributor

Aug 17, 2019

Yoni That works great, thank you!!

Lastly, how can I summarize based on the entirety of the datatable?

For example, treat each element in each array as its own value, and then list the top three most common values?

So if the data was:

["1", "2", "3", ""]

["4", "1", "1", ""]

["5", "4", "1", ""]

["6", "4", "2", ""]

Then the output would be (doesn't really matter what order):

Value

Yoni

Microsoft

Aug 17, 2019

datatable(EventData:dynamic)
[
	dynamic({"Tiles":["1", "2", "3", ""]}),
	dynamic({"Tiles":["4", "1", "1", ""]}),
	dynamic({"Tiles":["5", "4", "1", ""]}),
	dynamic({"Tiles":["6", "4", "2", ""]}),
]
| mv-expand Value = EventData.Tiles
| where isnotempty(Value)
| summarize count() by toint(Value)
| top 3 by count_
| project Value

bphillips09
Copper Contributor
Aug 17, 2019
Yoni Awesome, works great, thank you for all your help! I have a lot to learn but you've helped a huge amount.