Kusto - Custom Names for Rows fetched using IN condition

Question

I'm trying to display custom names for the Row data fetched using IN condition in Kusto.

Below is the table structure-

Below is the query I've used-

customEvents
| project Action=customDimensions["ActionInvoked"]
| where Action in (
    "viewSelected",
    "myProjectsSelected",
    "watchlistSelected"
)
| summarize count() by tostring(Action) 
| sort by count_
| render columnchart

The output to the query is as below-

As noticed in the output highlighted column names ("viewSelected","myProjectsSelected" & "watchlistSelected") are being rendered as is. These are not User friendly and I'd like to change it.

NOTE: I'm just a day old to Kusto, so my query might be bad. Please feel free to change it to a better one if needed.

I've answered your question. In the future, please post questions with minimal sample input in datatable format (as I did in my answer), to save time to those who want to help you :) — Slavik N

Slavik N Slavik N · Accepted Answer · 2021-06-13T05:13:53

You'll need to replace your original values in the Action column by the names you want to be displayed. The easiest way to do it is to use the case function like this (look at the | extend Action = case(...) part):

customEvents
| project Action = tostring(customDimensions["ActionInvoked"])
| where Action in (
    "viewSelected",
    "myProjectsSelected",
    "watchlistSelected"
)
| extend Action = case(
    Action == "viewSelected", "Default Views",
    Action == "myProjectsSelected", "Custom Views",
    "Watchlist")
| summarize count() by Action
| sort by count_
| render columnchart

By the way, note that I moved the tostring higher up in the query, for convenience.

And here's how the new query works on your data:

datatable(Action:string) [
    "viewSelected",
    "myProjectsSelected",
    "watchlistSelected",
    "watchlistSelected",
    "viewSelected"
]
| extend Action = case(
    Action == "viewSelected", "Default Views",
    Action == "myProjectsSelected", "Custom Views",
    "Watchlist")
| summarize count() by Action

Output:

Action	count_
Default Views	2
Custom Views	1
Watchlist	2

Kusto - Custom Names for Rows fetched using IN condition

1 Answers