azure-application-insightskqlazure-dashboard

How to retreive custom property corresponding to another property in azure


I am trying to write a kusto query to retrieve a custom property as below. enter image description here

I want to retrieve count of pkgName and corresponding organization. I could retrieve the count of pkgName and the code is attached below.

let mainTable = union customEvents
    | extend name =replace("\n", "", name)
    | where iif('*' in ("*"), 1 == 1, name in ("*"))
    | where true;
let queryTable = mainTable;
let cohortedTable = queryTable
    | extend dimension = customDimensions["pkgName"]
    | extend dimension = iif(isempty(dimension), "<undefined>", dimension)
    | summarize hll = hll(itemId) by tostring(dimension)
    | extend Events = dcount_hll(hll)
    | order by Events desc
    | serialize rank = row_number()
    | extend dimension = iff(rank > 10, 'Other', dimension)
    | summarize merged = hll_merge(hll) by tostring(dimension)
    | project ['pkgName'] = dimension, Counts = dcount_hll(merged);
cohortedTable

Please help me to get the organization along with each pkgName projected.


Solution

  • Please try this simple query:

    customEvents
    | summarize counts=count(tostring(customDimensions.pkgName)) by pkgName=tostring(customDimensions.pkgName),organization=tostring(customDimensions.organization)
    

    Please feel free to modify it to meet your requirement.

    If the above does not meet your requirement, please try to create another table which contains pkgName and organization relationship. Then use join operator to join these tables. For example:

        //create a table which contains the relationship
        let temptable = customEvents
        | summarize by pkgName=tostring(customDimensions.pkgName),organization=tostring(customDimensions.organization);
        
        //then use the join operator to join these tables on the keyword pkgName.