, parseurl - . , json.
"" :
pageViews
| where timestamp > ago(1d)
| extend parsed_url=parseurl(url)
| extend query = tostring(parsed_url["Query Parameters"]["query"])
:
pageViews
| where timestamp > ago(1d)
| extend parsed_url=parseurl(url)
| extend query = tostring(parsed_url["Query Parameters"]["query"])
| extend param = toint(parsed["Query Parameters"]["param"])
| summarize sum(param) by query
, :
let vals = datatable(url:string)["https://example.com/dir01/?
query=apple¶m=1", "https://example.com/dir01/?query=apple¶m=1",
"https://example.com/dir01/?query=lemon+juice¶m=1",
"https://example.com/dir01/?query=lemon+juice¶m=0",
"https://example.com/dir01/?query=tasteful+grape+wine¶m=1"];
vals
| extend parsed = parseurl(url)
| extend query = tostring(parsed["Query Parameters"]["query"])
| extend param = toint(parsed["Query Parameters"]["param"])
| summarize sum(param) by query
, ,