Kusto 查询以通过 dcount() 计算总数的百分比

Question

我是 Kusto 语言的新手，我正在尝试创建一个查询来计算唯一用户级别的总数百分比。比率列没有 return 任何结果 - 也许我做错了：/有没有更好的方法来做到这一点？

let T2 = T1 
|where timesstamp >ago(1m) and variable =='ss'
|summarize col_1 = dcount(user) by bin(timesstamp, 1s)
;
let T3 = T1
|where timesstamp >ago(1m) and variable in ('ss', 'ss1', 'ss2', 'ss3')
|summarize col_2 = dcount(user) by bin(timesstamp, 1s)
;
T3
| join T2 on timesstamp
|extend ratio =tolong(col_1/col_2)*100

Answer 1

你可以试试这个：

let T1 = datatable(timestamp:datetime, variable:string, user:string)
[
    datetime(2020-09-03 03:14:35), "ss", "u1",
    datetime(2020-09-03 03:14:35), "ss1", "u1",
    datetime(2020-09-03 03:14:35), "ss2", "u1",
    datetime(2020-09-03 03:14:35), "ss2", "u2",
    datetime(2020-09-03 03:14:36), "ss", "u2",
    datetime(2020-09-03 03:14:37), "ss", "u2",
    datetime(2020-09-03 03:14:37), "ss", "u1",
    datetime(2020-09-03 03:14:37), "ss2", "u1",
    datetime(2020-09-03 03:14:37), "ss1", "u2",
    datetime(2020-09-03 03:14:37), "ss3", "u3",
]
;
let T2 = T1 
    | where timestamp > ago(10m) and variable == 'ss'
    | summarize col_1 = dcount(user) by bin(timestamp, 1s)
;
let T3 = T1
    | where timestamp > ago(10m) and variable in ('ss', 'ss1', 'ss2', 'ss3')
    | summarize col_2 = dcount(user) by bin(timestamp, 1s)
;
T3
| join T2 on timestamp
| project timestamp, col_1, col_2, ratio = round(100.0 * col_1 / col_2, 2)

--->

| timestamp                   | col_1 | col_2 | ratio |
|-----------------------------|-------|-------|-------|
| 2020-09-03 03:14:35.0000000 | 1     | 2     | 50    |
| 2020-09-03 03:14:36.0000000 | 1     | 1     | 100   |
| 2020-09-03 03:14:37.0000000 | 2     | 3     | 66.67 |

Kusto 查询以通过 dcount() 计算总数的百分比

Kusto query to calculate % of the total by dcount()

kql