Dynamically choose column to filter on

Question

I'm trying to dynamically create a query and filter from a table not known at compile time (specifically, I want to filter on id if I'm querying the requests table, operation_ParentId otherwise). The following fails because id is not a column in the exceptions table:

let dataset = exceptions;
dataset
| where (itemType == "request" and id == "test") or (itemType != "request" and operation_ParentId == "test")

Thanks in advance!

Answer 1

This can be done using columnifexists():

let dataset = exceptions;
dataset
| where (itemType == "request" and columnifexists("id", operation_ParentId) == "test") or (itemType != "request" and operation_ParentId == "test")

Answer 2

You can ‘union’ the two tables:

let dataset = union exceptions, requests;
...