Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
In this article
Applies to: ✅ Azure Data Explorer ✅ Azure Monitor ✅ Microsoft Sentinel
Builds the minimal schema that admits all values of DynamicExpr.
Note
This function is used in conjunction with the summarize operator.
buildschema
(
DynamicExpr)
Learn more about syntax conventions.
Name | Type | Required | Description |
---|---|---|---|
DynamicExpr | dynamic |
✔️ | Expression used for the aggregation calculation. |
Returns the minimal schema that admits all values of DynamicExpr.
Tip
If the input is a JSON string, use the parse_json() function to convert the JSON to a dynamic value. Otherwise, an error might occur.
The following example builds a schema based on:
{"x":1, "y":3.5}
{"x":"somevalue", "z":[1, 2, 3]}
{"y":{"w":"zzz"}, "t":["aa", "bb"], "z":["foo"]}
datatable(value: dynamic) [
dynamic({"x":1, "y":3.5}),
dynamic({"x":"somevalue", "z":[1, 2, 3]}),
dynamic({"y":{"w":"zzz"}, "t":["aa", "bb"], "z":["foo"]})
]
| summarize buildschema(value)
Results
schema_value |
---|
{"x":["long","string"],"y":["double",{"w":"string"}],"z":{"indexer ":["long","string"]},"t":{"indexer ":"string"}} |
In the resulting schema:
- The root object is a container with four properties named
x
,y
,z
, andt
. - Property
x
is either type long or type string. - Property
y
is either type double or another container with a propertyw
of type string. - Property
z
is an array, indicated by theindexer
keyword, where each item can be either type long or type string. - Property
t
is an array, indicated by theindexer
keyword, where each item is a string. - Every property is implicitly optional, and any array might be empty.