从 json 格式文本创建列答案

【问题标题】：Create columns from json format text从 json 格式文本创建列
【发布时间】：2022-07-12 03:06:25
【问题描述】：

无论如何我可以在不使用“解析”功能的情况下完成以下工作吗？我的输入包含一个带有分隔文本的字段，其中有一个列名，后跟“=”，然后是值。我想创建一个以 = 前面的名称命名的列，然后插入后面的值作为值。

let Traces = datatable(EventText:string)
[
"Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=23, lockTime=02/17/2016 08:40:01, releaseTime=02/17/2016 08:40:01, previousLockTime=02/17/2016 08:39:01)",
"Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=15, lockTime=02/17/2016 08:40:00, releaseTime=02/17/2016 08:40:00, previousLockTime=02/17/2016 08:39:00)",
"Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=20, lockTime=02/17/2016 08:40:01, releaseTime=02/17/2016 08:40:01, previousLockTime=02/17/2016 08:39:01)",
"Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=22, lockTime=02/17/2016 08:41:01, releaseTime=02/17/2016 08:41:00, previousLockTime=02/17/2016 08:40:01)",
"Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=16, lockTime=02/17/2016 08:41:00, releaseTime=02/17/2016 08:41:00, previousLockTime=02/17/2016 08:40:00)"
];
Traces
| project data = replace_string(extract(@"\(([^\)]+)", 1, EventText), "=", ":")
| extend data = parse_json(data)
| evaluate bag_unpack(data)

【问题讨论】：

您是指parse 运算符吗？你有反对意见吗？

标签： parsing kql

【解决方案1】：

let Traces = datatable(EventText:string)
[
"Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=23, lockTime=02/17/2016 08:40:01, releaseTime=02/17/2016 08:40:01, previousLockTime=02/17/2016 08:39:01)",
"Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=15, lockTime=02/17/2016 08:40:00, releaseTime=02/17/2016 08:40:00, previousLockTime=02/17/2016 08:39:00)",
"Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=20, lockTime=02/17/2016 08:40:01, releaseTime=02/17/2016 08:40:01, previousLockTime=02/17/2016 08:39:01)",
"Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=22, lockTime=02/17/2016 08:41:01, releaseTime=02/17/2016 08:41:00, previousLockTime=02/17/2016 08:40:01)",
"Event: NotifySliceRelease (resourceName=PipelineScheduler, totalSlices=27, sliceNumber=16, lockTime=02/17/2016 08:41:00, releaseTime=02/17/2016 08:41:00, previousLockTime=02/17/2016 08:40:00)"
];
Traces
| project   kv = extract(@"\((.*)\)", 1, EventText)
| extend    kv = extract_all(@"(.*?)=([^,]*)", kv)
| mv-apply  kv on (summarize kv = make_bag(bag_pack(tostring(kv[0]), kv[1])))
| evaluate  bag_unpack(kv)

lockTime	, previousLockTime	, releaseTime	, sliceNumber	, totalSlices	resourceName
02/17/2016 08:40:01	02/17/2016 08:39:01	02/17/2016 08:40:01	23	27	PipelineScheduler
02/17/2016 08:40:00	02/17/2016 08:39:00	02/17/2016 08:40:00	15	27	PipelineScheduler
02/17/2016 08:40:01	02/17/2016 08:39:01	02/17/2016 08:40:01	20	27	PipelineScheduler
02/17/2016 08:41:01	02/17/2016 08:40:01	02/17/2016 08:41:00	22	27	PipelineScheduler
02/17/2016 08:41:00	02/17/2016 08:40:00	02/17/2016 08:41:00	16	27	PipelineScheduler

Fiddle

【讨论】：