I have a statement where I try to concatenate logs (strings) together to a single string.
Something like this
ContainerLog
| where conditions
| summarize strcat(LogEntry)
However I cant figure out how to concatenate strings like this since strcat is not an aggregating function. I need something else but don't know what.
How can I do this?
For example if I have log entries "1","2","3" the final result should be "123"
This allows a distinct combination in concrete.
requests
| where URL contains "prod"
| summarize count(), code=make_set(resultCode) by name
| sort by count_ desc
Reference: https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/summarizeoperator, https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/makeset-aggfunction
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With