graph-mark-components operator (Preview)

Applies to: ✅ Microsoft FabricAzure Data ExplorerAzure MonitorMicrosoft Sentinel

The graph-mark-components operator finds all connected components of a graph and marks each node with a component identifier.

Note

This operator is used in conjunction with the make-graph operator.

Syntax

G | graph-mark-components [kind = Kind] [with_component_id = ComponentId]

Parameters

Name Type Required Description
G string ✔️ The graph source.
Kind string The connected component kind, either weak (default) or strong. A weak component is a set of nodes connected by a path, ignoring the direction of edges. A strong component is a set of nodes connected in both directions, considering the edges' directions.
ComponentId string The property name that denotes the component identifier. The default property name is ComponentId.

Returns

The graph-mark-components operator returns a graph result, where each node has a component identifier in the ComponentId property. The identifier is a zero-based consecutive index of the components. Each component index is chosen arbitrarily and might not be consistent across runs.

Examples

Find families by their relationships

The following example creates a graph from a set of child-parent pairs and identifies connected components using a family identifier.

let ChildOf = datatable(child:string, parent:string) 
[ 
  "Alice", "Bob",  
  "Carol", "Alice",  
  "Carol", "Dave",  
  "Greg", "Alice",  
  "Greg", "Dave",  
  "Howard", "Alice",  
  "Howard", "Dave",  
  "Eve", "Frank",  
  "Frank", "Mallory",
  "Eve", "Kirk",
]; 
ChildOf 
| make-graph child --> parent with_node_id=name
| graph-mark-components with_component_id = family
| graph-to-table nodes

Output

name family
Alice 0
Bob 0
Carol 0
Dave 0
Greg 0
Howard 0
Eve 1
Frank 1
Mallory 1
Kirk 1

Find a greatest common ancestor for each family

The following example uses the connected component family identifier and the graph-match operator to identify the greatest ancestor of each family in a set of child-parent data.

let ChildOf = datatable(child:string, parent:string) 
[ 
  "Alice", "Bob",  
  "Carol", "Alice",  
  "Carol", "Dave",  
  "Greg", "Alice",  
  "Greg", "Dave",  
  "Howard", "Alice",  
  "Howard", "Dave",  
  "Eve", "Frank",  
  "Frank", "Mallory",
  "Eve", "Kirk",
]; 
ChildOf 
| make-graph child --> parent with_node_id=name
| graph-mark-components with_component_id = family
| graph-match (descendant)-[childOf*1..5]->(ancestor)
  project name = ancestor.name, lineage = childOf.child, family = ancestor.family
| summarize (generations, name) = argmax(array_length(lineage),name) by family

Output

family generations name
1 2 Mallory
0 2 Bob