union 运算符union operator

• 02/08/2021
• • o
  • a
  • v

获取两个或多个表，并返回表中的所有行。Takes two or more tables and returns the rows of all of them.

Table1 | union Table2, Table3

语法Syntax

T | union [UnionParameters] [kind= inner|outer] [withsource=ColumnName] [isfuzzy= true|false] Table [, Table]...T | union [UnionParameters] [kind= inner|outer] [withsource=ColumnName] [isfuzzy= true|false] Table [, Table]...

不带管道输入的替代形式：Alternative form with no piped input:

union [UnionParameters] [kind= inner|outer] [withsource=ColumnName] [isfuzzy= true|false] Table [, Table]...union [UnionParameters] [kind= inner|outer] [withsource=ColumnName] [isfuzzy= true|false] Table [, Table]...

参数Arguments

返回Returns

一个表，其中的行数与所有输入表中的行数相同。A table with as many rows as there are in all the input tables.

备注Notes

示例：名称或列中包含字符串的表Example: Tables with string in name or column

union K* | where * has "Kusto"

数据库中名称以 K 开头的所有表中有任意列包括单词 Kusto 的行。Rows from all tables in the database whose name starts with K, and in which any column includes the word Kusto.

示例：非重复计数Example: Distinct count

union withsource=SourceTable kind=outer Query, Command
| where Timestamp > ago(1d)
| summarize dcount(UserId)

过去一天已生成 Query 事件或 Command 事件的不同用户数。The number of distinct users that have produced either a Query event or a Command event over the past day. 在结果中，“SourceTable”列会指示“Query”或“Command”。In the result, the 'SourceTable' column will indicate either "Query" or "Command".

Query
| where Timestamp > ago(1d)
| union withsource=SourceTable kind=outer 
   (Command | where Timestamp > ago(1d))
| summarize dcount(UserId)

此效率更高的版本可生成相同结果。This more efficient version produces the same result. 它可在创建联合之前筛选每个表。It filters each table before creating the union.

示例：使用 isfuzzy=trueExample: Using isfuzzy=true

// Using union isfuzzy=true to access non-existing view:                                     
let View_1 = view () { print x=1 };
let View_2 = view () { print x=1 };
let OtherView_1 = view () { print x=1 };
union isfuzzy=true
(View_1 | where x > 0), 
(View_2 | where x > 0),
(View_3 | where x > 0)
| count 

观察查询状态 - 返回以下警告：Failed to resolve entity 'View_3'Observing Query Status - the following warning returned: Failed to resolve entity 'View_3'

// Using union isfuzzy=true and wildcard access:
let View_1 = view () { print x=1 };
let View_2 = view () { print x=1 };
let OtherView_1 = view () { print x=1 };
union isfuzzy=true View*, SomeView*, OtherView*
| count 

观察查询状态 - 返回以下警告：Failed to resolve entity 'SomeView*'Observing Query Status - the following warning returned: Failed to resolve entity 'SomeView*'

示例：源列类型不匹配Example: source columns types mismatch

let View_1 = view () { print x=1 };
let View_2 = view () { print x=toint(2) };
union withsource=TableName View_1, View_2

let View_1 = view () { print x=1 };
let View_2 = view () { print x=toint(2) };
let View_3 = view () { print x_long=3 };
union withsource=TableName View_1, View_2, View_3 

来自 View_1 的列 x 收到了后缀 _long，并且因为结果架构中已存在名为 x_long 的列，所以对列名称执行了删除重复数据的操作，生成了新列 - x_long1Column x from View_1 received the suffix _long, and as a column named x_long already exists in the result schema, the column names were de-duplicated, producing a new column- x_long1