I have 2 KQL queries and I want to combine them in order to display two rows as one result. Not just result of first query, then result of second query:
R_CL
| where isnotempty(SrcIP_s)
| project Message
| take 1;
R_CL
| where isempty(SrcIP_s)
| project Message
| take 1
See sample R_L below.I would like to see 2 rows as result, one with SrcIP_s not empty, and the second with SrcIP_s empty (in this case it will be always same one)
let R_CL = datatable ( SrcIP_s:string, Message:string)
["1.1.1.1" ,"one",
"" ,"two",
"2.2.2.2","three",
"3.3.3.3","four"];
R_CL
| project SrcIP_s, Message
A simple solution for this would be to use the union operator like this:
let query1 = R_CL
| where isnotempty(SrcIP_s)
| project Message
| take 1;
let query2 = R_CL
| where isempty(SrcIP_s)
| project Message
| take 1;
query1
| union query2;
I know this is an old request - but here's a sample query using views and a union for your single query:
Your two separate queries...
R_CL
| where isnotempty(SrcIP_s)
| project Message
| take 1;
R_CL
| where isempty(SrcIP_s)
| project Message
| take 1
would become:
let Query1 = view () {
R_CL
| where isnotempty(SrcIP_s)
| project Message
| take 1;
};
let Query2 = view () {
R_CL
| where isempty(SrcIP_s)
| project Message
| take 1
};
union withsource="TempTableName" Query1, Query2
Related
I'm coding in python (PySide2), but the overall concept concerns the Qt Framework.
Here are two tables of mine:
Table "recordings":
| Column | Type |
| -------- | -------------------|
| id | int (primary key) |
| param1 | int |
| param2 | int |
| ... | int |
| paramN | int |
Table "analyzed_recs":
| Column | Type |
| -------- | -------------------|
| id | int (primary key) |
| rec_id | int (foreign key) | <-- Points to recordings.id
| paramN | int |
I need in my program to display param1 and param2 from the former. In Qt I used a QSqlRelationalTable to fulfill this objective:
def _init_db_models(self):
self.analyzed_recs_sql_model = QSqlTableModel(self, self.db)
self.analyzed_recs_sql_model.setTable("analyzed_recs")
rec_id = self.analyzed_recs_sql_model.fieldIndex('rec_id')
self.analyzed_recs_sql_model.setRelation(rec_id, QSqlRelation("recordings", "id", "param1"))
self.analyzed_recs_sql_model.setRelation(rec_id, QSqlRelation("recordings", "id", "param2"))
self.analyzed_recs_sql_model.select()
self.analyzed_data_table.setModel(self.analyzed_recs_sql_model)
This code works fine in displaying the desired fields.
However, when it comes to update a record in analyzed_recs:
record = self.analyzed_recs_sql_model.record()
record.remove(record.indexOf("id"))
record.setValue("rec_id", self.current_rec_id)
record.setValue("param1", self.param1)
record.setValue("param2", param2)
self.analyzed_recs_sql_model.insertRecord(-1, record)
self.analyzed_recs_sql_model.submitAll()
The column rec_id is not set (NULL) into the table (the other params are correctly inserted into the table).
On the contrary, if I avoid using QSqlRelationalTableModel and take QSqlTableModel instead, the insertion is performed correctly (as I expected), but I lose the INNER JOIN display feature.
I was thinking as a work around to create two distinct models, a QSqlRelationalTableModel only for displaying and a QSqlTableModel only for editing the data. However I don't like the extra workload of syncing the two.
I'm sure there is a Qt feature to achieve this, but unfortunately I'm missing it.
Any suggestion?
I've had the same problem using PYQT.
The record object returned by calling record() method has no fields named 'rec_id' because the QSqlRelationalTableModel changes it with the referenced field name 'param1'. We can verify the field names using:
fieldcount = record.count()
for i in range(fieldcount):
logging.info("field %s %s", i, record.fieldName(i))
so we need to add the field before assigning it:
record = self.analyzed_recs_sql_model.record()
record.remove(record.indexOf("id"))
record.append(QSqlField("rec_id"))
record.setValue("rec_id", self.current_rec_id)
Query1
cluster(x).database('$systemdb').Operations
| where Operation == "DatabaseCreate" and Database contains "oci-"| where State =='Completed'
and StartedOn between (datetime(2020-04-07) .. 3d)
| distinct Database , StartedOn
| order by StartedOn desc
Output of my query1 is list of databases , now I have to pass each db value into query2 to get buildnumber
Query2:
set query_take_max_records=5000;
let view=datatable(Property:string,Value:dynamic)[];
let viewFile=datatable(FileName:string)[];
alias database db = cluster(x).database('y');
let latestInfoFile = toscalar((
union isfuzzy=true viewFile,database('db').['TextFileLogs']
| where FileName contains "AzureStackStampInformation"
| distinct FileName
| order by FileName
| take 1));
union isfuzzy=true view,(
database('db').['TextFileLogs']
| where FileName == latestInfoFile
| distinct LineNumber,FileLineContent
| order by LineNumber asc
| summarize StampInfo=(toobject(strcat_array(makelist(FileLineContent,100000), "\r\n")))
| mvexpand bagexpansion=array StampInfo
| project Property=tostring(StampInfo[0]), Value=StampInfo[1]
)|where Property contains "StampVersion" | project BuildNumber = Value;
database() function: is a special scoping function, and it does not support non-constant arguments due to security consideration.
As a result - you cannot use sub-query to fetch list of databases and then operate on this list as input for database() function.
This behavior is described at:
https://learn.microsoft.com/en-us/azure/kusto/query/databasefunction?pivots=azuredataexplorer
Syntax
database(stringConstant)
Arguments
stringConstant: Name of the database that is referenced. Database identified can be either DatabaseName or PrettyName. Argument has to be constant prior of query execution, i.e. cannot come from sub-query evaluation.
I have a table like below in Room, in a Android application, I use Raw Query to get data. Can it be sorted by second value in array sorting_field?
---------------------------------------------
| id | other_fields | sorting_field |
---------------------------------------------
| 1001 | … | ["24","0.02","2"] |
---------------------------------------------
Initially I did the sorting part in Repository with Transformations.switchMap, inside the function a MutableLiveData> and applied Collections.sort.
It worked like a charm:
Collections.sort(list, (o1, o2) -> Double.compare(Double.valueOf(o1.sorting_field().get(positionInList)), Double.valueOf(o2.sorting_field().get(positionInList))));
After Paging implementation, I took the sorting logic out, moved to queries builder and here I am.
There is an LocalStorage example in the Qt documentation
function findGreetings() {
var db = LocalStorage.openDatabaseSync("QQmlExampleDB", "1.0", "The Example QML SQL!", 1000000);
db.transaction(
function(tx) {
// Some other commands
// Show all added greetings
var rs = tx.executeSql('SELECT * FROM Greeting');
}
)
}
What's the data type of rs?
See the Quick Local Storage QML module documentation:
results = tx.executeSql(statement, values)
This method executes a SQL statement, binding the list of values to
SQL positional parameters ("?").
It returns a results object, with the following properties:
| Type | Property | Value | Applicability |
-----------------------------------------------------------------------------------------
| int | rows.length | The number of rows in the result | SELECT |
-----------------------------------------------------------------------------------------
| var | rows.item(i) | Function that returns row i of the result | SELECT |
-----------------------------------------------------------------------------------------
| int | rowsAffected | The number of rows affected by a modification | UPDATE,DELETE |
-----------------------------------------------------------------------------------------
| string | insertId | The id of the row inserted | INSERT |
results = tx.executeSql(statement, values)
This method executes a SQL statement, binding the list of values to SQL positional parameters ("?").
It returns a results object, with the following properties: link
If all you want is to know the type of returned object, just do:
var rs = tx.executeSql(...);
console.log(rs);
qml: [object Object]
I'm working with Azure Mobile Services and have a table with GUIDs as its Primary Key (RecordId). I need to retrieve the previous and next rows of the table based on an ID.
Example of table:
| RecordId | RecordText |
|--------------------------------------|------------|
| 25892e17-80f6-415f-9c65-7395632f0223 | Hello |
| a53e98e4-0197-4513-be6d-49836e406aaa | Bye |
| e33898de-6302-4756-8f0c-5f6c5218e02e | Byebye |
| 3a768eea-cbda-4926-a82d-831cb89092aa | Wow |
Sample Input:
1) I enter a53e98e4-0197-4513-be6d-49836e406aaa
2) I enter e33898de-6302-4756-8f0c-5f6c5218e02e
Sample Output:
1) I'll get three results: 25892e17-80f6-415f-9c65-7395632f0223 (Previous), a53e98e4-0197-4513-be6d-49836e406aaa (Current), e33898de-6302-4756-8f0c-5f6c5218e02e (Next)
2) I'll get three results: a53e98e4-0197-4513-be6d-49836e406aaa (Previous), e33898de-6302-4756-8f0c-5f6c5218e02e (Current), 3a768eea-cbda-4926-a82d-831cb89092aa (Next)
How would I go about implementing this, and would I do this from the Node.js backend of from my ASP.NET? The use case here is a webpage where I can click Previous or Next buttons to go to the corresponding records.