I need to pass the column name dynamically into the query. While following is syntactically correct it does not really execute the condition on the particular column.

Is this even possible in Kusto?

let foo = (duration: timespan, column:string) {
    SigninLogs
    | where TimeGenerated >= ago(duration) 
    | summarize totalPerCol = count() by ['column']
};
//foo('requests')<-- does not work
//foo('user') <-- does not work
//foo('ip')<-- does not work

CodePudding user response：

you can try using the column_ifexists() function: https://docs.microsoft.com/en-us/azure/data-explorer/kusto/query/columnifexists.

for example:

let foo = (column_name:string) {
    datatable(col_a:string)["hello","world"]
    | summarize totalPerCol = count() by column_ifexists(column_name, "")
};
foo('col_a')