I'm having an issue with trying a pretty straightforward case in KQL, while I'm trying to set a dependency of the 'Breakdown by' field (a field that enables to breakdown of the graphs in various ways) with a CASE/ Meaning in case that my 'Breakdown by' field is set to 'campaign_final' I would like to remove all 'Organic' traffic from the data Seems like the go-to way is CASE - but I'm always open to any other operational way :)
The relevant script is:
let breakdown = 'campaign_final';
MyTable
| where install_date >= ago(30d)
| extend dim = column_ifexists(breakdown,"ERROR")
| extend dim = case(dim == campaign_final, isnotempty(campaign_final), tostring('error'))
| sample 30
I'm getting the below error: case: return types are not compatible. Number of different types: Distinct types: I8,StringBuffer.
What am I missing here? why isn't the last 'error2' isn't a string?
I would like that when dim == campaign_final then all the empty (Organic traffic) campaign_final will be removed from the data
Many thanks!
I tried to switch data types, using null values, and changing different parameters in the script
look at the argument for the following statement:
the first argument is of type
bool, it's the condition you're evaluating.the second argument (chosen if the condition is
true) is of typebool, which is the return type of the functionisnotempty()that you're using.the third argument (chosen if the condition is
false) is of typestring.i.e. - you have a type mismatch between the types of the 2nd and 3rd arguments, as the
casestatement can return only a specific type, and that type can't be conditional.i didn't understand this part. you may want to clarify your desire using a simple example - a small input data set, and the desired output that matches it.