Search code examples
azure-data-explorerkql

Project columns based on list of column names in Kusto / Data Explorer


I have a Kusto table that have hundreds of columns. About half of the columns contain dates. Each date column has the word 'date' in it's name (For example: 'createdDate'). I would like to return only columns that contain "date" in the column name.

(Of note, the values in the "date" columns are strings)

I am trying to do the following:

let T1 = datatable (col1:string, col2:string, Date1:string, Date2:string)[
"abc", "def", "2021-11-3", "2021-11-4",
"ghi", "jkl", "2021-11-5", "2021-11-6",
"mno", "pqr", "2021-11-7", "2021-11-8",
"stu", "v", "2021-11-9", "2021-11-10",
"wx", "yz", "2021-11-11", "2021-11-12"];
let ColswithDates = T1
| getschema 
| where ColumnName contains "date";
T1 | project ColswithDates

Solution

  • Use "project-keep" operator

    let T1 = datatable (col1:string, col2:string, Date1:string, Date2:string)[
    "abc", "def", "2021-11-3", "2021-11-4",
    "ghi", "jkl", "2021-11-5", "2021-11-6",
    "mno", "pqr", "2021-11-7", "2021-11-8",
    "stu", "v", "2021-11-9", "2021-11-10",
    "wx", "yz", "2021-11-11", "2021-11-12"];
    let ColswithDates = T1
    | getschema 
    | where ColumnName contains "date";
    T1 | project-keep *Date*
    
    Date1 Date2
    2021-11-3 2021-11-4
    2021-11-5 2021-11-6
    2021-11-7 2021-11-8
    2021-11-9 2021-11-10
    2021-11-11 2021-11-12