基于标签值创建变量：Kusto中实现costcenter标签值到部门名称的映射

Got it, let's get this sorted for you! You're already off to a great start by extracting the costcenter tag value into a cost column. Now we just need to add a step to map specific values like "AB12" to their corresponding department names.

Basic Single Mapping (for just HR Department) #

If you only need to map "AB12" to "HR Department" and leave other cost center values as-is, use the iif() function in an additional extend statement:

resources
| extend cost = tostring(tags['costcenter'])
| extend department = iif(cost == "AB12", "HR Department", cost)

• The iif() function checks if cost equals "AB12":
  • If true, it sets department to "HR Department"
  • If false, it keeps the original cost value

Scalable Multiple Mappings #

If you anticipate needing to map more cost center values to departments later, use the case() function instead—it’s cleaner for multiple conditions:

resources
| extend cost = tostring(tags['costcenter'])
| extend department = case(
    cost == "AB12", "HR Department",
    cost == "CD34", "Finance Department",
    cost == "EF56", "IT Department",
    cost // Fallback to original value if no match is found
)

Using This in Charts #

Once you have the department column, simply select it as the category or series in your chart instead of the cost column. This will display the friendly department names (like "HR Department") instead of the raw "AB12" code.

内容的提问来源于stack exchange，提问作者robertuxo