How to pass column name to toscalar function? - kql

Question

I have a kusto table with one of the columns as dynamic type with nested json.
If I use ColumnName in toscalar function, I will get this error. Is there any way to do this, or it is impossble?
let T = datatable(ColumnName:dynamic)
[
dynamic({"OtherField": "Unknown","First": [{"Id": "","Second": [{"ConfidenceLevel": "Low","Count": 3}]},{"Id": "","Second":[{"ConfidenceLevel": "High","Count": 0}]}]}),
dynamic({"OtherField": "Unknown","First": [{"Id": "","Second": [{"ConfidenceLevel": "Low","Count": 3}]},{"Id": "","Second":[{"ConfidenceLevel": "High","Count": 2}]}]})
];
let result = T
// The following line works, but regex is not allowed during review.
// | where tostring(ColumnName) matches regex '"ConfidenceLevel":"High","Count":[^0]'
| where isnotnull(toscalar(
// print s = '{"OtherField": "Unknown","First": [{"Id": "","Second": [{"ConfidenceLevel": "Low","Count": 3}]},{"Id": "","Second":[{"ConfidenceLevel": "High","Count": 0}]}]}'
print s = tostring(ColumnName) // Error here: The name 'ColumnName' does not refer to any column, table, varible or function.
| project obj0 = parse_json(s)
| mv-expand obj1 = obj0.First
| mv-expand obj2 = obj1.Second
| where obj2.ConfidenceLevel == "High" and obj2.Count > 0)
)
;
result
I tried and confirmed it was caused by toscalar function.
Expected result (The second row will be selected):
ColumnName
{"OtherField":"Unknown","First":[{"Id":"","Second":[{"ConfidenceLevel":"Low","Count":3}]},{"Id":"","Second":[{"ConfidenceLevel":"High","Count":2}]}]}

Answer 1

The documentation is very clear about this:
"The toscalar() function can't be applied on row-level (for-each-row scenario)."
Nested mv-apply, to deal with the nested arrays
let T = datatable(ColumnName:dynamic)
[
dynamic({"OtherField": "Unknown","First": [{"Id": "","Second": [{"ConfidenceLevel": "Low","Count": 3}]},{"Id": "","Second":[{"ConfidenceLevel": "High","Count": 0}]}]}),
dynamic({"OtherField": "Unknown","First": [{"Id": "","Second": [{"ConfidenceLevel": "Low","Count": 3}]},{"Id": "","Second":[{"ConfidenceLevel": "High","Count": 2}]}]})
];
T
| mv-apply ColumnName.First on
(
mv-apply ColumnName_First.Second on
(
where ColumnName_First_Second.ConfidenceLevel == "High"
and ColumnName_First_Second.Count > 0
)
)
| project ColumnName
ColumnName
{"OtherField":"Unknown","First":[{"Id":"","Second":[{"ConfidenceLevel":"Low","Count":3}]},{"Id":"","Second":[{"ConfidenceLevel":"High","Count":2}]}]}
Fiddle