graph-mark-components operator (preview)

Applies to: ✅ Azure Data Explorer ✅ Azure Monitor ✅ Microsoft Sentinel

The graph-mark-components operator finds all connected components of a graph and marks each node with a component identifier.

Note

This operator is used with the make-graph operator.

Syntax

G | graph-mark-components [kind = Kind] [with_component_id = ComponentId]

Parameters

Name	Type	Required	Description
G	string	✔️	The graph source.
Kind	string		The connected component kind, either `weak` (default) or `strong`. A weak component is a set of nodes connected by a path, ignoring the direction of edges. A strong component is a set of nodes connected in both directions, considering the edges' directions.
ComponentId	string		The property name that denotes the component identifier. The default property name is `ComponentId`.

Returns

The graph-mark-components operator returns a graph result, where each node has a component identifier in the ComponentId property. The identifier is a zero-based consecutive index of the components. Each component index is chosen arbitrarily and might not be consistent across runs.

Examples

The following example creates a graph from a set of child-parent pairs and identifies connected components using a family identifier.

Run the query

let ChildOf = datatable(child:string, parent:string) 
[ 
  "Alice", "Bob",  
  "Carol", "Alice",  
  "Carol", "Dave",  
  "Greg", "Alice",  
  "Greg", "Dave",  
  "Howard", "Alice",  
  "Howard", "Dave",  
  "Eve", "Frank",  
  "Frank", "Mallory",
  "Eve", "Kirk",
]; 
ChildOf 
| make-graph child --> parent with_node_id=name
| graph-mark-components with_component_id = family
| graph-to-table nodes

Output

name	family
Alice	0
Bob	0
Carol	0
Dave	0
Greg	0
Howard	0
Eve	1
Frank	1
Mallory	1
Kirk	1

The following example uses the connected component family identifier and the graph-match operator to identify the greatest ancestor of each family in a set of child-parent data.