Search code examples
azurekqlazure-log-analytics

How can I combine rows based on two columns matching in KQL?


I am trying to get a number of rows combined within a table in a KQL log analytics query. My current query result, or input table, is this:

id name InstanceId MonthlyPreTaxCost
vm-for-oe-ip 0.247
vmtest-ip 0.263
test-orphaned-ip test-orphaned-ip
vmTest-ip vmTest-ip

What I want, is a result that contains only a single record: vmTest-ip as the id, the name, and then the MonthlyPreTaxCost associated with that id:

id name InstanceId MonthlyPreTaxCost
vmTest-ip vmTest-ip vmtest-ip 0.263

I initially thought I should do this using a self join, but I cannot get the condition check (id == InstanceId) right. Inner joining on itself, for example, gives this:

id name InstanceId MonthlyPreTaxCost id1 name1 InstanceId1 MonthlyPreTaxCost1
vmtest-ip 0.263 test-orphaned-ip test-orphaned-ip
vm-for-oe-ip 0.247 test-orphaned-ip test-orphaned-ip
vmtest-ip 0.263 vmTest-ip vmTest-ip
vm-for-oe-ip 0.247 vmTest-ip vmTest-ip

How can I achieve my desired result?


Solution

  • The solution turned out to be quite simple: change the condition check to be non-case sensitive (=~ instead of ==). This fixed my problem.