Kusto Query Language: set column name of summarize by evaluated expression

Question

Me again asking another Kusto related question (I really wish there would be a thorough video tutorial on this somewhere).

I have a summarize statement, that produces two columns for y axis and one for x axis. Now i want to relabel the columns for x axis to show a string, that i also got from the database and already put into a variable with let.

This basically looks like this:

let android_col = strcat("Android: ", toscalar(customEvents
| where application_Version contains secondLatestVersionAndroid));
let iOS_col = strcat("iOS: ", toscalar(customEvents
| where application_Version contains secondLatestVersionIOS));

... some Kusto magic ...

| summarize
    Android = 100 - (round((countif(hasUnhandledErrorAndroid == 1 ) * 100.0 ) / countif(isAndroid == 1), 2)),
    iOS = 100 - (round((countif(hasUnhandledErroriOS == 1) * 100.0 ) / countif(isIOS == 1), 2))
    by Time
|render timechart with (ytitle="crashfree users in %", xtitle="date", legend=visible )

Now i want to have the summarize display not Android and iOS, but the value of android_col and iOS_col.

Is that possible?

Best regards Maverick

Slavik N Slavik N · Accepted Answer · 2020-10-13T14:47:01

Generally, it's suggested to have predefined column names, otherwise various features don't work. For example, IntelliSense won't know the names of the columns, as they would be determined at run time only. Also, if you create a function that returns a dynamic schema, you won't be able to run this function from other clusters.

However, if you do want to change column names, you definitely have a way to do it by using various plugins. For example, bag_unpack, pivot and others.

As for courses on Kusto, there are actually several excellent courses on Pluralsight (all are free):

Kusto Query Language: set column name of summarize by evaluated expression

2 Answers