Kusto if Array contains array then return no results

Question

I want to write kusto query that should basically return no results if three records are present in the variable. Here is an example:

    let someValues = datatable (name: string)
    [
     "111",
     "222",
     "333",
    ];

// my query

So if the someValues variable contains all the three strings - "111", "222", "333" then my query should return no results. If it contains only 2 of them "111", "222" then it should just return false. If it contains 1 of them "222" then also it should return false. But if it contains all three strings "111", "222", "333" then the query should not return any results.

Here is my attempt but it doesn't work.

let someValues = datatable (name: string)
[
 "111",
 "222",
 "333",
];
someValues
| summarize make_set(name)
| where set_name contains "111" and set_name contains "222" and set_name contains "333" // this doesn't work because it outputs 1 row

Here is an equivalent C# program for that.

static void Main(string[] args)
{
    List<string> s = new List<string>() {"111", "222", "333"};
    if (s.Contains("111") && s.Contains("222") && s.Contains("333"))
        return; // no results
    else
    {
        Console.WriteLine("False"); // prints false
    }
}

It seems like over complication of logic that should be done by whomever is calling the query — David דודו Markovitz
– David דודו Markovitz, Commented Dec 1, 2022 at 5:59
We are setting up an alert in azure. If the query returns rows then alert will be sent. If the query doesn't return results then no alert will be sent. And when three rows are in the list then 0 rows should be returned by the query, so no alert should be sent. — Varun Sharma
– Varun Sharma, Commented Dec 1, 2022 at 7:39

David דודו Markovitz · Accepted Answer · 2022-12-01 07:56:50Z

1

let someValues = datatable (name: string)
[
 "111",
 "222",
 "333"
];
let values = dynamic(["111", "222", "333"]);
someValues
| summarize make_set(name)
| project   diff_is_empty_set = array_length(set_difference(values, set_name)) == 0
| where     not(diff_is_empty_set)

Fiddle

edited Dec 1, 2022 at 7:56

answered Dec 1, 2022 at 7:51

David דודו Markovitz

45.2k7 gold badges75 silver badges97 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Kusto if Array contains array then return no results

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related