Skip to content

Instantly share code, notes, and snippets.

@WesSec
Last active September 7, 2022 11:24
Show Gist options
  • Save WesSec/c8d8a65038633bfbccbe5a79d632e59b to your computer and use it in GitHub Desktop.
Save WesSec/c8d8a65038633bfbccbe5a79d632e59b to your computer and use it in GitHub Desktop.
Advanced hunting: Only return columns that contain values
<Query>
| extend values = pack_all()
| mv-apply values on
(
mv-expand kind = array values
| where isnotempty(values[1])
| summarize EmptyValuesRemoved = make_bag(pack(tostring(values[0]), values[1]))
)
| project EmptyValuesRemoved
| evaluate bag_unpack(EmptyValuesRemoved)
// credits: https://stackoverflow.com/questions/66414407/is-it-possible-in-kusto-to-only-return-columns-with-values
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment