I'm trying to apply a simple transformation on an array of strings (dynamic type).

For the sake of the example, I want to map an array of strings. Each string to wrap in dashes - ["a", "b", "c"] => ["---a---", "---b---", "---c---"]

I tried:

let foof = (fooTable: dynamic) {
fooTable | mv-apply fooTable on ( project abc=strcat("---", fooTable, "---") | summarize make_list(abc))
};
let fooTable = datatable(str: string, record: dynamic) [
    "name1", dynamic(["a", "b", "c"]),
    "name2", dynamic(["a", "b", "c"]),
    "name3", dynamic(["a", "b", "c"]),
];
fooTable | project abc=foof(record)

I'm expecting to get the mapped three rows (the UDF applied on each row).

Seems like I got it right without the UDF:

fooTable | mv-apply record on (
    project abc=strcat("--", record, "---") | summarize make_list(abc)
)

but I'm doing something wrong with the UDF.

But I get:

Operator source expression should be table or column

I'm trying to change only the UDF, so in the KQL I'll only call the UDF on the given column.

CodePudding user response：

your UDF should have a tabular argument instead of a scalar one, and you can use the invoke operator:

let foof = (fooTable: (record: dynamic)) {
fooTable | mv-apply record on ( project abc=strcat("---", record, "---") | summarize abc = make_list(abc))
};
let fooTable = datatable(str: string, record: dynamic) [
    "name1", dynamic(["a", "b", "c"]),
    "name2", dynamic(["a", "b", "c"]),
    "name3", dynamic(["a", "b", "c"]),
];
fooTable | invoke foof() // you can also replace this line with "foof(fooTable)"

Regarding your comments -

• assuming I understood your verbal description correctly - you could try this:
• otherwise, please clarify/provide an example as requested.

let some_variable = dynamic(['a','b','c']);
let foof = (some_variable: dynamic) {
    toscalar(
        print some_variable
        | mv-apply v = some_variable on ( project v = strcat("---", v, "---"))
        | summarize make_set(v)
    );
};
let T = datatable(str: string) [
    "---abc---",
    "---a---",
    "---b---d---c",
];
T
| where str has_any (foof(some_variable))