0

I have a list containing the keys and another list containing values (obtained from splitting a log line). How can I combine the two to make a proeprty-bag in Kusto?

let headers = pack_array("A", "B", "C");
datatable(RawData:string)
[
    "1,2,3",
    "4,5,6",
]
| expand fields = split(RawData, ",")
| expand dict = ???

Expected:

dict
-----
{"A": 1, "B": 2, "C": 3}
{"A": 4, "B": 5, "C": 6}
Jenny
  • 2,041
  • 13
  • 15
  • it may be better if could share the original input (from which you created both arrays) - it could be easier to reach the required dictionary directly from it, without the 2 arrays – Yoni L. May 06 '21 at 15:59
  • @Yoni thanks. I have updated the question – Jenny May 06 '21 at 16:42

1 Answers1

3

Here's one option, that uses the combination of:

let keys = pack_array("A", "B", "C");
datatable(RawData:string)
[
    "1,2,3",
    "4,5,6",
]
| project values = split(RawData, ",")
| mv-apply with_itemindex = i key = keys to typeof(string) on (
    summarize dict = make_bag(pack(key, values[i]))
)
values dict
[
"1",
"2",
"3"
]		 {
"A": "1",
"B": "2",
"C": "3"
}
[
"4",
"5",
"6"
]		 {
"A": "4",
"B": "5",
"C": "6"
}
Yoni L.
  • 22,627
  • 2
  • 29
  • 48
  • Thanks for taking the time to answer the question. As I mentioned, the `values` array is extract from a log line. I have updated my questions to clarify the scenario – Jenny May 06 '21 at 16:41
  • the reply was updated according to your update – Yoni L. May 06 '21 at 17:21
  • Note that it's recommended to use `bag_pack()` instead of `pack()` now since the latter is deprecated. Detail see [bag_pack() - Azure Data Explorer | Microsoft Learn](https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/packfunction) – johnnyasd12 Nov 22 '22 at 06:57