How to filter the records in Kusto
I am trying to get the event names in each department by Id. I tried with filters and othe but unable to get it. Any inputs?
Solution
you could try using the make_set() aggregation function.
for example:
T
| summarize make_set(Event) by DeptId, DeptName
- Is there a query to run so I can get a list of users who has NOT logged in, in the past 30 days?
- Compare multiple column value and return column name with max value
- trying to find out week of year in kql
- Azure Data Explorer - plot graph per user over time
- Parse array & json to right numbers of column
- Turning off Kusto database cache policy not reflecting in reduced cache as shown by .show cache command
- Kusto command for generating create table & function script
- Get percent value from total sum row in pivot mode
- How to ingest inline into Azure Data Explorer Table from PowerShell?
- Using KQL and externaldata() operator to pull infromation from json file
- ADF Copy activity is making double column in adx as "infinity" for 1.7976931348623157E308 value
- Can I send data from Azure monitor / fabric to metabase
- KQL: how to exclude first and last incomplete bin?
- KQL query to extend new column with other row values
- How to create an empty bag in KQL?
- Column contains text contains other column
- Kql function to append columns
- Applying a KQL query to the transform_kql parameter through terraform
- KQL query to list the secrets and keys in keyvault that are expired or going to expire in 7 days
- Monitor HTTP traffic for Azure Web App using Log analytics and KQL query
- How to hide or change legend in "Run query and visualize results" logic app function?
- How to calculate time difference between the latest entries of two indirectly tables in Kusto (KQL)?
- Calculate the number of overlapping days for each device using KQL
- How good is performance of "has" operator in Kusto when RHS is not exactly one term?
- how to retrieve all resources under given subnet using Azure Resource Graph Explorer query
- Count how many elements are in an array created by make_set in kusto language
- Inserting data in KQL
- Stuck at PIM Diagnostics via KQL
- union with all fields
- How to create an Alert for Data Collection Rule deletion across all VMs in a subscription?