title: Turn series to columns in Kusto/Azure Data Explorer
body: <p>I am trying to turn a Windows event log xml event data in Azure Logs (kusto) into columns, so given the EventData array in the xml as returned by parse_xml(),how do I turn it into columns?</p>
  
  <p>I tried mvexplode which gave me rows (series), but then I would like to turn those into columns where col name is the attribute "Name" in the  tag and value is the text property.</p>
  
  <p>Windows event log xml below for reference</p>
  
  <p><code>&lt;EventData xmlns="http://schemas.microsoft.com/win/2004/08/events/event"&gt;
    &lt;Data Name="DomainPolicyChanged"&gt;Password Policy&lt;/Data&gt;
    &lt;Data Name="DomainName"&gt;XXX&lt;/Data&gt;
    &lt;Data Name="DomainSid"&gt;S-1-5-21-....&lt;/Data&gt;
    &lt;Data Name="SubjectUserSid"&gt;S-1-5-18&lt;/Data&gt;
    &lt;Data Name="SubjectUserName"&gt;SRV-XX-001$&lt;/Data&gt;
    &lt;Data Name="SubjectDomainName"&gt;DOMAIN&lt;/Data&gt;
    &lt;Data Name="SubjectLogonId"&gt;0x3e7&lt;/Data&gt;
    &lt;Data Name="PrivilegeList"&gt;-&lt;/Data&gt;
    &lt;Data Name="MinPasswordAge"&gt;&lt;/Data&gt;
    &lt;Data Name="MaxPasswordAge"&gt;&lt;/Data&gt;
    &lt;Data Name="ForceLogoff"&gt;&lt;/Data&gt;
    &lt;Data Name="LockoutThreshold"&gt;耠&lt;/Data&gt;
    &lt;Data Name="LockoutObservationWindow"&gt;&lt;/Data&gt;
    &lt;Data Name="LockoutDuration"&gt;&lt;/Data&gt;
    &lt;Data Name="PasswordProperties"&gt;耠-&lt;/Data&gt;
    &lt;Data Name="MinPasswordLength"&gt;-&lt;/Data&gt;
    &lt;Data Name="PasswordHistoryLength"&gt;-&lt;/Data&gt;
    &lt;Data Name="MachineAccountQuota"&gt;-&lt;/Data&gt;
    &lt;Data Name="MixedDomainMode"&gt;1&lt;/Data&gt;
    &lt;Data Name="DomainBehaviorVersion"&gt;8&lt;/Data&gt;
    &lt;Data Name="OemInformation"&gt;12&lt;/Data&gt;
  &lt;/EventData&gt;
  </code></p>