I have a Kusto function, let's call it B,
which accepts dynamic content and then uses mv-expand
to perform some queries and returns the data to the called function, let's call it A.
The returned data table should be joined back to the original data to perform the rest of the operations in A.
To perform the join operation on a unique ID, I am extending the original table in function A with GUIDs and then converting it to a scalar to pass it to B, as shown below.
let x= datatable(EndTime:datetime, Event:string) [
datetime(1910-06-11), "foo",
datetime(1930-01-01), "bar",
datetime(1930-01-01), "foo bar"
];
let data = x
| project EndTime, Event
| extend Id = new_guid();
data;
let scalar_events = toscalar
(
data
| project scalar = pack_all()
| summarize scalar = make_list(scalar)
);
print(scalar_events)
The GUIDs in the data table and the ones in the scalar_events are different after the toscalar operation; I also tried converting the IDs to string and then passing; even the stringified GUIDs are regenerated, and it does not retain the original values.
let x= datatable(EndTime:datetime, Event:string) [
datetime(1910-06-11), "foo",
datetime(1930-01-01), "bar",
datetime(1930-01-01), "foo bar"
];
let data = x
| project EndTime, Event
| extend Id = tostring(new_guid());
data;
let scalar_events = toscalar
(
data
| project scalar = pack_all()
| summarize scalar = make_list(scalar)
);
print(scalar_events);
Is there a way to preserve this and return it to be used for joining? Any help will be appreciated,
As @YoniL pointed out, this is because of how Kusto preprocesses its queries; it does not work how we expect a traditional programming language to work. To get around this problem and tell Kusto to use the actual data without re-evaluating it, we need the Materialize function:
let x= datatable(EndTime:datetime, Event:string) [
datetime(1910-06-11), "foo",
datetime(1930-01-01), "bar",
datetime(1930-01-01), "foo bar"
];
let data = materialize
(
x | extend Id = tostring(new_guid())
);
data;
let scalar_events = toscalar
(
data
| project scalar = pack_all()
| summarize scalar = make_list(scalar)
);
print(scalar_events);