Walk Through Guide for Kusto Detective Agency Season 2, Case #5 Solution
Cases Solutions: 0 1 2 3 4 5 6 7 8 9 10
There is no fire without Prof. smoke! 🔥
The fifth case riddle is:
The key takeaways from the riddle:
- We’re looking for a backup of a deleted video
- The videoes are part of a popular podcast with thousands of views
- This is a weekly podcast
⚠SPOILER ALERT — THE SOLUTION DESCRIBED BELOW⚠
Note: Solution is mine, and non-official
So let’s delve into the data, by leveraging the | take 10, to see some rows.
Interesting let’s see what different transactions we have:
Lucky us🍀KQL has the parse operator to efficiently parse (semi-)structured strings:
OK!
Time to leverage we know the podcast 1000s of views:
To make an interesting analysis in an ocean of data, it’s more convenient to work on a series.
Lucky us🍀KQL has the make-series operator:
The suspicious series should have an anomaly, especially with a negative trend due to the missing episode.
Lucky us🍀KQL has the series_decompose_anomalies function:
Nonetheless, we know it’s a weekly podcast so it has weekly seasonality:
All we want to know is what are the backup files for this suspicious host:
To sum up the whole query would be:
Gotcha Prof. Smoke!
Enjoyed this article? Feel free to long-press the 👏 button below 😀
Click for Next Case Solution ➡
