Use KQL query to return a list of column names - kql

I'm creating a workbook in Microsoft Sentinel, and I want to add some parameters to make the queries populating the panels more flexible. Specifically, I want to have a drop-down parameter with a list of all column names for a given table. This column name will be then be used in downstream queries.
Is there a KQL query that can return all column names for a given table? It looks like .show isn't supported in Log Analytics/Sentinel
Worst comes to worst I can make it a text field but would strongly prefer to have a drop-down menu

Related

Dynamic Parameter in Power Pivot Query

We are using Excel 2013 and Power Pivot to build modules that consist of several Pivot tables that are all pulling data from the same Power Pivot table, which queries our T-SQL data warehouse.
In an effort to simplify and fully automate this module, we wanted to create a text field that would allow a user to enter a value (a client ID# for example), and then have that value be used as a parameter in the Power Pivot query.
Is it possible to pass a Parameter in the Power Pivot query, which is housed in a text field outside of the query?
You can also pass a slicer or combobox selection to a cell. Define a name for that cell. Put that cell (and others if you have multiple text variables to use) in a table. For convenience, I usually name this table "Parameters". You can then 'read in' the parameters to your query and drop them in your query statements.
The code at the top of your query to read these parameters in might look like...
let
Parameter_Table = Excel.CurrentWorkbook(){[Name="Parameter"]}[Content],
XXX_Value = Parameter_Table{1}[Value],
YYY_Value = Parameter_Table{2}[Value],
ZZZ_Value = Parameter_Table{3}[Value],
Followed by your query wherein instead of searching for, say a manually typed in customer called "BigDataCo", you would replace "BigDataCo" with XXX_Value.
Refreshing the link each time a different customer is selected will indeed be a very slow approach, but this has worked for me.
Rather than pass a parameter to the data source SQL query, why not utilize a pivot table filter or slicer to do allow the users to dynamically filter the data? This is much faster than refreshing the data from the source.
If for some reason you need to pass this directly to the source query, you'll have to do some VBA work.

Best way to handle multi-valued fields as a view/grid

In several notes applications, instead of handling related data as separate documents, if the size of the data is small (less than the 32k limit), I'll make several multi valued fields and display it in what I call a "List Panel". It's a table where each column displays one multi-value field. Since fielda(1) goes with fieldb(1) that goes with fieldc(1) there is a concept of rows. (I did a similar thing in my auditing routine discussed here )
It is always assumed that each field has exactly the same number of elements.
All the multi-value fields are then stored on the single document. This avoids several coding conventions that made my eyes bleed like having date changed, who changed it, new value fields for each field we wanted to audit. Another thing that this kept to a minimum was having to provide multiple fields for the same thing that locked you into a limit. Taxrate1, Taxrate2, Taxrate3, etc...
In my "Listpanel" the first column is a vertical checkbox. (One for each element in my lists) This is so I can select one item to bring up and edit, or select multiple values to delete "rows" or apply some kind of mass change to them.
What would be the best way to handle this under xPages to get this functionality? I tried making a table but am having the devil of a time to get the checkboxes to line up with their corresponding data items.
Views and dojo-grids seem to assume we're using a document for each row.....
This TableWalker may provide what you want http://www-10.lotus.com/ldd/ddwiki.nsf/dx/Tutorial-Introduction-to-XPages-Exercise-23
It was created when XPages was all very new, so it's SSJS rather than Java. But if you're comfortable wiith Java, converting it probably won't be a challenge.
You could use a repeat control to display the values and build a table using the table row tags in the repeat. You would want to calculate the id of the checkbox to be able to take an action on that selected row. The repeat var would be just one of your multi-value fields and you use the index of the repeat to get the value for that row from the other multi-value fields.

Create SQL String in Microsoft Access Dynamically

I apologize if this is an easy one, but I can't find this on the web anywhere!
I have a list of tables and queries, and a full list of fields from each table and query.
I want to choose my fields in an Access form, and then, on another form, choose a query/table in one column (along with a field) and join it to a table/query in another column (along with the field.) My form for the joins would look like this:
Object1 Field1 Object2 Field2
and so on. I would want to be able to choose my fields through combo boxes, THEN make the SQL string dynamically. I can't use a where clause -- it has to be a join.
The problem is, the structure will change every time. Access gets funny about putting in parentheses. Also, if an object is chosen more than once, Access will want to join it (assuming I do it right) in a different manner than T-SQL.
Is there a way to write a query in T-SQL, and quickly convert to Access? Does anyone know the FROM clause algorithm Access uses to construct the FROM clause? I am stuck here, and I cannot find a solution to save my soul! Thank you in advance, David

Appending Multi-value lists

I have an Access 2007 data entry form that is bound to a table that is used solely as a holding station for the data until it is reviewed and appended to the permanent tables. There are several fields in the table (and thus form) that have multi-value selections (derived from a look-up table query). The user does not care if the data is searchable so storing in the text field as a long list is fine. The problem is with appending. I cannot append multi-value lists to a table.
I noticed that if I save the table as an excel spreadsheet and then import it back into a table with the same database structure as the exporting table but without multi-value combo boxes for those fields requiring multi-values (they are now just text boxes) that the list is there and formatted the way I want.
So I am thinking, what code is Access using to export the correct values to Excel and could I just use similar coding to append to the permanent tables (which don’t have to have the corresponding text fields formatted as a multi-value list) instead of having to export to an Excel file and then import this back into a new template? Please note that although some of the lists are only 10-15 options, one list has over 50 possible selections to choose from.
I am just trying to make a user friendly data entry interface without scores of vba coding (which I am a newbie at). Alternate ideas are welcome.
Internally, Access is doing just what Allen Browne's ConcatRelated function does. Fortunately, Allen's code will handle multi-valued fields so you can just use it in a query like this
INSERT INTO MainTable ( MealType, Meats )
SELECT MealType, ConcatRelated("Meats","TempTable","TempID=" & [TempID]) AS Expr1
FROM TempTable;
where [MainTable].[Meats] is Text(255) and [TempTable].[Meats] is a multi-valued Lookup field.

Access 2010 Database Clenup

I have problems with my records within my database, so I have a template with about 260,000 records and for each record they have 3 identification columns to determine what time period the record is from and location: one for year, one for month, and one for region. Then the information for identifying the specific item is TagName, and Description. The Problem I am having is when someone entered data into this database they entered different description for the same device, I know this because the tag name is the same. Can I write code that will go through the data base find the items with the same tag name and use one of the descriptions to replace the ones that are different to have a more uniform database. Also some devices do not have tag names so we would want to avoid the "" Case.
Also moving forward into the future I have added more columns to the database to allow for more information to be retrieved, is there a way that I can back fill the data to older records once I know that they have the same tag name and Description once the database is cleaned up? Thanks in advance for the information it is much appreciated.
I assume that this will have to be done with VBA of some sort to modify records by looking for the first record with that description and using a variable to assign that description to all the other items with the same tag name? I just am not sure of the correct VBA syntax to go about this. I assume a similar method would be used for the backfilling process?
Your question is rather broad and multifaceted, so I'll answer key parts in steps:
The Problem I am having is when someone entered data into this
database they entered different description for the same device, I
know this because the tag name is the same.
While you could fix up those inconsistencies easily enough with a bit of SQL code, it would be better to avoid those inconsistencies being possible in the first place:
Create a new table, let's call it 'Tags', with TagName and TagDescription fields, and with TagName set as the primary key. Ensure both fields have their Required setting to True and Allow Zero Length to False.
Populate this new table with all possible tags - you can do this with a one-off 'append query' in Access jargon (INSERT INTO statement in SQL).
Delete the tag description column from the main table.
Go into the Relationships view and add a one-to-many relation between the two tables, linking the TagName field in the main table to the TagName field in the Tags table.
As required, create a query that aggregates data from the two tables.
Also some devices do not have tag names so we would want to avoid the
"" Case.
In Access, the concept of an empty string ("") is different from the concept of a true blank or 'null'. As such, it would be a good idea to replace all empty strings (if there are any) with nulls -
UPDATE MyTable SET TagName = Null WHERE TagName = '';
You can then set the TagName field's Allow Zero Length property to False in the table designer.
Also moving forward into the future I have added more columns to the
database to allow for more information to be retrieved
Think less in terms of more columns than more tables.
I assume that this will have to be done with VBA of some sort to modify records
Either VBA, SQL, or the Access query designers (which create SQL code behind the scenes). In terms of being able to crunch through data the quickest, SQL is best, though pure VBA (and in particular, using the DAO object library) can be easier to understand and follow.