I don't really understand what's the issue if you want to use the command distinct and distinct count AFTER a project or extend operators.
let planting_table = ['events.all']
| where FullName_Name == "plant_seed"
| extend SeedName = EventData.Payload.SeedName,
OasisName = EventData.Payload.OasisName,
TileName = EventData.Payload.TileName
| project-away SchemaVersion, FullName_Namespace, Entity_Id, Entity_Type,
EntityLineage_title, EventData, EntityLineage_title_player_account,
EntityLineage_namespace, ExperimentVariants, FullName_Name
| project-rename id = EntityLineage_master_player_account
;
planting_table
| summarize dcount(SeedName) by id
My goal is to make a distinct count of the seedname by ID in Kusto / KQL. How can I do that? Why I cannot use distinct after a extend or a project operator?
Thanks for the help!
try casting the dynamic
property named SeedName
to string
, using the tostring()
function, so that you can aggregate over it using the distinct
operator.
i.e.
...
| extend SeedName = tostring(EventData.Payload.SeedName),
...
| summarize dcount(SeedName) by id