3

I have a statement where I try to concatenate logs (strings) together to a single string.

Something like this

ContainerLog
| where conditions
| summarize strcat(LogEntry)

However I cant figure out how to concatenate strings like this since strcat is not an aggregating function. I need something else but don't know what.

How can I do this?

For example if I have log entries "1","2","3" the final result should be "123"

Bomaz
  • 1,871
  • 1
  • 17
  • 22

1 Answers1

8

This allows a distinct combination in concrete.

requests
| where URL contains "prod"
| summarize count(), code=make_set(resultCode) by name
| sort by count_ desc

Image

Reference: https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/summarizeoperator, https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/makeset-aggfunction

francisco neto
  • 797
  • 1
  • 5
  • 13
Nirav Gondaliya
  • 81
  • 1
  • 3
  • To make this answer complete (I assume you wanted to have string as a result) you have to join at the end: ``` requests | where URL contains "prod" | summarize count(), code=make_set(resultCode) by name | extend code=strcat_array(code, ", ") | sort by count_ desc ``` – Max Jul 10 '21 at 22:01