0

I have a problem which bothers me even though i think the solution must be super simple. I have to build a query with Kusto Query Language for my Azure Analytics log analyzer metric.

I want to make this script working for the latest app version and for the second latest app version.

This is the query code to get the latest app version as a skalar.

customEvents
| where client_OS contains "Android"
| summarize max(application_Version)

Now my understanding would be, that i could store this in a let and use it later on to get the second latest app version like this:

let latestVersion = customEvents
| where client_OS contains "Android"
| summarize max(application_Version);
customEvents
| where client_OS contains "Android" and application_Version !contains latestVersion
|summarize max(application_Version)

But unfortunately the compiler wont let me use a skalar with !contains. I have to use a string. Is there any way for me to make string out of this, so i can use it? Or do you have any other good way to retrieve the second highest value from application_Version column? I created this according to how i would do it in SQL, but it seems that Kusto is a bit different.

I hope you can help me fixing this and enlighten me and enhance my Kusto skills.

Best regards, Maverick

Maverick1st
  • 3,774
  • 2
  • 34
  • 50

1 Answers1

2

latestVersion is not a scalar. To make it scalar, you have to surround it with toscalar(...).

In any case, if you want to find the top 2 items, there's a much more efficient way to do it:

customEvents
| where client_OS contains "Android"
| top 2 by application_Version desc
Slavik N
  • 4,705
  • 17
  • 23
  • 1
    Unfortunately this outputs the top two of the list but with the same application version. I need only the two top values of the application version. Like for example 2.1 and 2.0. – Maverick1st Oct 07 '20 at 11:16
  • 1
    However, that toscalar() acutally did the trick. So many thanks for that. – Maverick1st Oct 07 '20 at 11:28