How can I get a few variables from a single KQL query? - kql

Question

I have a query from which I want to get a few variables: street, house, locality, region, countryName
let orderDate = datetime('2022-02-10');
let orderId = '0A524A2F83CCB1A311EC827458D6C4F6';
raw_events
| where timestamp between (orderDate .. 1d)
| where messageType == 'OrderPlacedEvent'
| extend messageAsJSON=parse_json(message)
| where messageAsJSON.orderId == orderId
| extend street = messageAsJSON.address.street
| extend house = messageAsJSON.address.house
| extend locality = messageAsJSON.address.locality
| extend region = messageAsJSON.address.region
| extend countryName = messageAsJSON.address.countryName
Is there a better way of achieving that other than executing the same query a few times:
let orderDate = datetime('2022-02-10');
let orderId = '0A524A2F83CCB1A311EC827458D6C4F6';
let street = raw_events
| where timestamp between (orderDate .. 1d)
| where messageType == 'OrderPlacedEvent'
| extend messageAsJSON=parse_json(message)
| where messageAsJSON.orderId == orderId
| project street = messageAsJSON.address.street;
let house = raw_events
| where timestamp between (orderDate .. 1d)
| where messageType == 'OrderPlacedEvent'
| extend messageAsJSON=parse_json(message)
| where messageAsJSON.orderId == orderId
| project street = messageAsJSON.address.house;
print toscalar(street),toscalar(house);
UPDATE
Made it the following way
let addres2look4 = raw_events
| where timestamp between (orderDate .. 1d)
| where messageType == mType
| where message.orderId == orderId
| project address = message.address
| evaluate bag_unpack(address);
let countryName = toscalar(addres2look4 | project countryName);
let region = toscalar(addres2look4 | project region);
let locality = toscalar(addres2look4 | project locality);
let street = toscalar(addres2look4 | project street);
let house = toscalar(addres2look4 | project house);

Answer 1

Here's an efficient way to achieve this (note the use of the materialize() function):
let addres2look4 = materialize(
raw_events
| where timestamp between (orderDate .. 1d)
| where messageType == mType
| where message.orderId == orderId
| project address = message.address
| evaluate bag_unpack(address));
let countryName = toscalar(addres2look4 | project countryName);
let region = toscalar(addres2look4 | project region);
let locality = toscalar(addres2look4 | project locality);
let street = toscalar(addres2look4 | project street);
let house = toscalar(addres2look4 | project house);
The materialize() function caches the subquery's result during the time of query execution, so that the subsequent let statements will be much faster.