Kusto：如何将列转换为行并按行进行汇总

Question

我有一张这样的桌子：-

Type | shown | eaten  |
-----------------------
a    |  5    |   2    |
b    |  6    |   23   |
c    |  8    |   12   |
d    |  19   |   11   |
e    |  2    |   22   |
-----------------------

我想这样转换它：-

Type | action | count |
-----------------------
a    | shown  |  5    |
a    | eaten  |  2    |
b    | shown  |  6    |
b    | eaten  |  23   |
c    | shown  |  8    |
c    | eaten  |  12   |
d    | shown  |  19   |
d    | eaten  |  11   |
e    | shown  |  2    |
e    | eaten  |  22   |
-----------------------

如何为此编写 kql 查询？

Answer 1

这是一个选项（请注意，我将一些列名称更改为大写，因此不需要转义）。

datatable(Type: string, shown: int, eaten: int) [
"a",  5,  2,
"b",  6, 23,
"c",  8, 12,
"d", 19, 11,
"e",  2, 22]
| extend Temp = pack("shown",shown,"eaten",eaten )
| mv-expand kind=array Temp
| project Type, Action=tostring(Temp[0]), Count=toint(Temp[1])