I am trying to get a number of rows combined within a table in a KQL log analytics query. My current query result, or input table, is this:
id | name | InstanceId | MonthlyPreTaxCost |
---|---|---|---|
vm-for-oe-ip | 0.247 | ||
vmtest-ip | 0.263 | ||
test-orphaned-ip | test-orphaned-ip | ||
vmTest-ip | vmTest-ip |
What I want, is a result that contains only a single record: vmTest-ip as the id, the name, and then the MonthlyPreTaxCost associated with that id:
id | name | InstanceId | MonthlyPreTaxCost |
---|---|---|---|
vmTest-ip | vmTest-ip | vmtest-ip | 0.263 |
I initially thought I should do this using a self join, but I cannot get the condition check (id == InstanceId) right. Inner joining on itself, for example, gives this:
id | name | InstanceId | MonthlyPreTaxCost | id1 | name1 | InstanceId1 | MonthlyPreTaxCost1 |
---|---|---|---|---|---|---|---|
vmtest-ip | 0.263 | test-orphaned-ip | test-orphaned-ip | ||||
vm-for-oe-ip | 0.247 | test-orphaned-ip | test-orphaned-ip | ||||
vmtest-ip | 0.263 | vmTest-ip | vmTest-ip | ||||
vm-for-oe-ip | 0.247 | vmTest-ip | vmTest-ip |
How can I achieve my desired result?
The solution turned out to be quite simple: change the condition check to be non-case sensitive (=~ instead of ==). This fixed my problem.