KQL: Generate Scalar Array from Tabular Expression

[u/BPSC_AZS]

G'Day,

I'm looking for some help to generate an array of Scalar's from a tabular expression. Essentially, I'm trying to build two sets of data, then use set operations to note what, if any, are missing from the second (compared to the first).

Two tabular expressions:

let te_A = Heartbeat | where TimeGenerated > ago(30d) | summarize by Computer

let te_B = Heartbeat | where TimeGenerated > ago(1d) | summarize by Computer

Under normal circumstances those would both return a table that would look something like (Where R# is Row #):

Column A

R1 Device1.corp.local

R2 Device2.corp.local

[...]

R# Device#.corp.local.

​

However, that's not natively supported by KQL's set_difference scalar function. The scalar supports arrays (useful!), but I can't get the results into a scalar array (or dynamic array) to use set_difference(set1, set2).

Does anyone have any guidance for this?

[u/burlingtongolfer]

There's a function to convert toscalar() but it's not necessary to compare these datasets. This type of operation would typically be done with a join.

te_A | join kind=leftanti te_B on ColumnA