List comprehension equivalent in Kusto - kql

Question

I recently started to use the Azure Resource Graph Explorer to obtain resource information. KQL is a new thing I'm figuring out along the way, and one of the problems I need help with is a means to manipulate an array of dictionaries into just an array of string values.
As an example:
Consider the following data
{
"customerId": "201",
"orders": [
{
"dept": "/packaging/fruits"
},
{
"dept": "/packaging/vegetables"
}
]
}
With the following query:
Customers
| where customerId == 201
| project customerId, orders
The result would be as follows:
My question is, how can I modify the query to produce the following result:
Tried to go through the KQL documentation, but can't seem to find the correct method to achieve the above. Any help would be much appreciated!

Answer 1

in Kusto, you could use mv-apply:
datatable(customerId:int, orders:dynamic)
[
201, dynamic([
{
"dept": "/packaging/fruits"
},
{
"dept": "/packaging/vegetables"
}
]),
201,
dynamic([
{
"dept": "/packaging2/fruits2"
},
{
"dept": "/packaging2/vegetables2"
}
])
]
| where customerId == 201
| mv-apply orders on (
summarize orders = make_list(orders.dept)
)
customerId
orders
201
[ "/packaging/fruits", "/packaging/vegetables"]
201
[ "/packaging2/fruits2", "/packaging2/vegetables2"]
In ARG, mv-apply isn't supported, so you can use mv-expand:
datatable(customerId:int, orders:dynamic)
[
201, dynamic([
{
"dept": "/packaging/fruits"
},
{
"dept": "/packaging/vegetables"
}
]),
201,
dynamic([
{
"dept": "/packaging2/fruits2"
},
{
"dept": "/packaging2/vegetables2"
}
])
]
| where customerId == 201
| extend rn = rand()
| mv-expand orders
| summarize orders = make_list(orders.dept) by rn, customerId
| project-away rn
customerId
orders
201
[ "/packaging/fruits", "/packaging/vegetables"]
201
[ "/packaging2/fruits2", "/packaging2/vegetables2"]