能否基于特定值在Kusto中动态调整Projected列？

需求说明 #

在给定的数据表中，当IsActive字段值为1时仅投影Name列，否则同时投影Name和Company列。

示例数据表 #

let sampleTable = datatable(Name:string, Company:string, IsActive:bool, Location:string)
[   
    "ABC","Microsoft",1, "Redmond",
    "XYZ","Amazon",1, "Seattle",
    "EFG","Google",0, "Mountain View",
    "MNO","Facebook",0, "Menlo Park",
    "QRS","Apple",0, "Cupertino"
];

实现方案 #

可以通过拆分数据集分别处理后合并的方式实现需求，具体查询语句如下：

let sampleTable = datatable(Name:string, Company:string, IsActive:bool, Location:string)
[   
    "ABC","Microsoft",1, "Redmond",
    "XYZ","Amazon",1, "Seattle",
    "EFG","Google",0, "Mountain View",
    "MNO","Facebook",0, "Menlo Park",
    "QRS","Apple",0, "Cupertino"
];
// 拆分处理后合并结果
sampleTable
| where IsActive == 1
| project Name
| union kind=all
(
    sampleTable
    | where IsActive == 0
    | project Name, Company
)

方案说明 #

• 先筛选出IsActive为1的记录，仅保留Name列；
• 再筛选出IsActive为0的记录，保留Name和Company列；
• 最后用union kind=all将两个结果集合并，得到符合要求的输出。

内容的提问来源于stack exchange，提问作者Vinny