KQL related question -- How to make the a query that would combine 3 columns into one specific column

Question

KQL related question -- How to make the a query that would combine 3 columns into one specific column

Ranniell Dalope 0

I am trying to create a KQL query aggregate 3 different column that has the same TimeGenerated.
It has the same operation, but different values for the 2 other column.

What I am trying to see is:

| project TimeGenerated, AuditChange

AuditChange would result into [{Target:"",OldValue:"",NewValue:""}]

Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-06-05T12:59:12.1533333+00:00
Hello Ranniell Dalope,

You can pack each row’s three fields into a dynamic object and then aggregate them by TimeGenerated using summarize with make_list. That’ll give you a column where each entry is an array of objects like you described.

For example:

MyTable | where … // your filters | summarize AuditChange = make_list( pack( 'Target', Target, 'OldValue', OldValue, 'NewValue', NewValue ) ) by TimeGenerated | project TimeGenerated, AuditChange

Explanation

pack(...) creates a dynamic object per row with keys Target, OldValue, NewValue

make_list(...) collects all those objects into a JSON array for each TimeGenerated

project then shows just the two columns you want

If you need only unique change entries, swap make_list for make_set.

References:

https://learn.microsoft.com/azure/data-explorer/kusto/query/pack-function

https://learn.microsoft.com/azure/data-explorer/kusto/query/make-list-aggregation-function

Note: This content was drafted with the help of an AI system.
Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-06-08T11:14:04.59+00:00

Hello Ranniell Dalope,

Please confirm if you still have further queries on this

1 answer

Your answer

Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-06-05T12:59:12.1533333+00:00

Hello Ranniell Dalope,

You can pack each row’s three fields into a dynamic object and then aggregate them by TimeGenerated using summarize with make_list. That’ll give you a column where each entry is an array of objects like you described.

For example:

MyTable | where … // your filters | summarize AuditChange = make_list( pack( 'Target', Target, 'OldValue', OldValue, 'NewValue', NewValue ) ) by TimeGenerated | project TimeGenerated, AuditChange

Explanation

pack(...) creates a dynamic object per row with keys Target, OldValue, NewValue

make_list(...) collects all those objects into a JSON array for each TimeGenerated

project then shows just the two columns you want

If you need only unique change entries, swap make_list for make_set.

References:

https://learn.microsoft.com/azure/data-explorer/kusto/query/pack-function

https://learn.microsoft.com/azure/data-explorer/kusto/query/make-list-aggregation-function

Note: This content was drafted with the help of an AI system.
Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-06-08T11:14:04.59+00:00

Hello Ranniell Dalope,

Please confirm if you still have further queries on this

Answer 1

Use summarize to aggregate the rows that share the same TimeGenerated, then project a single dynamic column that combines the three fields into an array of objects.

Assuming the three columns are Target, OldValue, and NewValue, and each row with the same TimeGenerated has one set of values:

YourTable
| summarize AuditChange = make_list(
    pack(
        "Target",   Target,
        "OldValue", OldValue,
        "NewValue", NewValue
    )
) by TimeGenerated
| project TimeGenerated, AuditChange

Result shape:

TimeGenerated: one row per timestamp
AuditChange: dynamic array like [{"Target":"...","OldValue":"...","NewValue":"..."}, ...]

If there is only ever one row per TimeGenerated and you just want a single object instead of an array, use make_bag() instead of make_list() and adjust the pack() accordingly.

References: