kusto - table cell value RRS feed

  • Question

  • Hi all,

    I'm new to Kusto - and would like to know if it is possible to store the value of a table cell in a variable?

    for example, i have two custom ids. Only one row has both values, the rest of the events have only 'Id' filled in. I need to be able to use 'parentId' to get the value 'Id'

    event1   parentId    Id
    event2                   Id
    event3                   Id

    let extendedEvents = customEvents
    | extend parentId = tostring(customDimensions['parentId']) , requestId = tostring(customDimensions['Id']);

    let MyEvents = customEvents | where customDimensions != '' and tostring(customDimensions['Id']) != '' and tostring(customDimensions['time'] ) != '' and tostring(customDimensions['Id']) ==
    "Id from above????" ;

    Tuesday, May 7, 2019 11:11 PM

All replies

  • Hi Sa'Ed A'Rafat,

    Thank you for reaching out!

    Yes, it is possible to store the value of a table cell in a variable using the function toscalar()


    Here is a sample that you can use:

    let id = toscalar(customEvents
    | where customDimensions ['parentId'] != ''
    | project customDimensions ['Id'] );
    | where customDimensions ['Id'] == tostring(id)

    Here, the variable 'id' will store the value of customDimensions ['Id'] which has customDimensions ['parentId'] populated. You can query customEvents using that variable.

    You can also just use the below query without storing the Id in a variable:

    customEvents | where customDimensions ['parentId'] != '' | project customDimensions ['Id']

    Hope this helps!

    Thursday, May 9, 2019 5:21 AM
  • Thank you so much! The first one is exactly what i was looking for.
    Thursday, May 9, 2019 1:33 PM
  • You are most welcome :) Request you to also mark my response as an answer so that it helps the community as well. Thanks!
    Thursday, May 9, 2019 2:35 PM