Kusto查询中如何使用case函数按子串判断资源池类型

在Azure Data Explorer中查询MmsPoolProperty表时，该表未内置资源池类型标识字段，需要通过提取PoolName字段的子串判断资源池属性，判断规则如下：

• 若PoolName包含子串imc，归为*内部（Internal）*类型
• 若PoolName包含子串pmc或ghmc，归为*公共（Public）*类型

可使用如下Kusto语句实现需求：

MmsPoolProperty
| where TIMESTAMP > ago(1d)
| where ImageName contains "mac" or ImageName contains "osx"
| summarize arg_max(TIMESTAMP, AllPropertiesBlob) by PoolName // 待解耦方案全量上线足够长时间、旧遥测数据完全失效后，可移除该行逻辑
| extend props = parse_json(AllPropertiesBlob)
| project PoolName, UnitName = coalesce(props["VmControllerName"], PoolName) 
| extend PoolType = case(PoolName contains "imc","Internal",
                         PoolName contains "pmc","Public",
                         PoolName contains "ghmc","Public")

内容的提问来源于stack exchange，提问作者DevUps