try 创建一个哨兵查询(Kql)，该查询使用外部数据()操作符从JSON文件‘https://www.gov.uk/bank-holidays.json’.‘获取信息我发现的问题是由于这个包含列/字段‘date’的json文件不允许将其作为变量.有没有人能够从外部文件中获得多层json字段？
externaldata (title:string, date:string, notes:string, bunting:bool)[
@"https://www.gov.uk/bank-holidays.json"
]
with(format="multijson")
['date']或["date"]json个就够了.不需要multijson.title:string, date:string, notes:string, bunting:bool)."england-and-wales", "scotland" & "northern-ireland".txt或raw，将其解析为JSON，然后分解它，如下面的查询所示.externaldata(doc:string)
[h'https://<storage-account-name>.blob.core.windows.net/mycontainer/bank-holidays.json;<secret>']
with(format='txt')
| project parse_json(doc)
| mv-expand kind=array doc
| project kingdom = tostring(doc[0])
,division = doc[1].division
,events = doc[1].events
| mv-expand events
| evaluate bag_unpack(events)
//| sample 10
| kingfom | division | bunting | date | notes | title |
|---|---|---|---|---|---|
| northern-ireland | northern-ireland | false | 2017-04-14T00:00:00Z | Good Friday | |
| england-and-wales | england-and-wales | true | 2017-05-29T00:00:00Z | Spring bank holiday | |
| scotland | scotland | false | 2018-03-30T00:00:00Z | Good Friday | |
| england-and-wales | england-and-wales | true | 2018-12-25T00:00:00Z | Christmas Day | |
| northern-ireland | northern-ireland | false | 2019-04-19T00:00:00Z | Good Friday | |
| england-and-wales | england-and-wales | true | 2019-12-25T00:00:00Z | Christmas Day | |
| northern-ireland | northern-ireland | true | 2020-01-01T00:00:00Z | New Year’s Day | |
| scotland | scotland | true | 2022-01-04T00:00:00Z | Substitute day | 2nd January |
| scotland | scotland | false | 2022-09-19T00:00:00Z | Bank Holiday for the State Funeral of Queen Elizabeth II | |
| scotland | scotland | true | 2023-01-02T00:00:00Z | Substitute day | New Year’s Day |