3

I have an application insights query. And in this query I want to join/combine several columns into a single column for display how can this be accomplished.

I want to combine ip, city, state, country.

customEvents
| where timestamp >= ago(7d)
| where (itemType == 'customEvent')
| where name == "Signin"
| project timestamp, customDimensions.appusername,   client_IP,client_City,client_StateOrProvince, client_CountryOrRegion 
| order by timestamp desc
John Gardner
  • 24,225
  • 5
  • 58
  • 76
Piotr Zaremba
  • 195
  • 2
  • 9

1 Answers1

6

strcat is your friend, with whatever strings you want as separators (i just use spaces in the example):

| project timestamp, customDimensions.appusername, 
  strcat(client_IP," ",client_City," ",client_StateOrProvince," ", client_CountryOrRegion)

also, the | where (itemType == 'customEvent') in your query is unnecessary, as everything in the customEvents table is already a customEvent. you only need a filter like that on itemType if you join multiple tables somehow (like union requests, customEvents or a join somewhere in your query that references multiple tables)

John Gardner
  • 24,225
  • 5
  • 58
  • 76