Kusto：如何从不参与 SUMMARIZE 的列中获取值？

Question

有了下面的 table 和 Kusto 查询，我如何才能获得包含“购买”列的结果？

let ProductsTable = datatable(Supplier: string, Fruit: string, Price: int, Purchase: datetime)
[
    'Contoso', 'Grapes', 220, datetime(2018-10-01 01:00),
    'Fabrikam', 'Lemons', 31, datetime(2018-10-01 02:00),
    'Contoso', 'Lemons', 29, datetime(2018-10-02 03:00),
    'Contoso', 'Grapes', 210, datetime(2018-10-02 04:00),
    'Fabrikam', 'Lemons', 30, datetime(2018-10-03 05:00),
    'Contoso', 'Bananas', 12, datetime(2018-10-03 06:00),
    'Contoso', 'Bananas', 12, datetime(2018-10-04 07:00),
    'Contoso', 'Lemons', 29, datetime(2018-10-04 08:00),
    'Contoso', 'Grapes', 200, datetime(2018-10-05 09:00),
];
ProductsTable
    | summarize Price = min(Price) by Supplier, Fruit
    | order by Supplier asc, Fruit asc, Price asc

结果

Contoso Bananas 12
Contoso Grapes      200
Contoso Lemons      29
Fabrikam    Lemons      30

期望的结果

Contoso Bananas 12  2018-10-03 06:00
Contoso Grapes      200 2018-10-05 09:00
Contoso Lemons      29  2018-10-02 03:00
Fabrikam    Lemons      30  2018-10-03 05:00

我知道可能有多个结果，例如对于 Contoso-Bananas-12 我们可以有以下任何一个

2018-10-03 06:00
2018-10-04 07:00

Answer 1

尝试使用 arg_min()：https://docs.microsoft.com/en-us/azure/kusto/query/arg-min-aggfunction

let ProductsTable = datatable(Supplier: string, Fruit: string, Price: int, Purchase: datetime)
[
    'Contoso', 'Grapes', 220, datetime(2018-10-01 01:00),
    'Fabrikam', 'Lemons', 31, datetime(2018-10-01 02:00),
    'Contoso', 'Lemons', 29, datetime(2018-10-02 03:00),
    'Contoso', 'Grapes', 210, datetime(2018-10-02 04:00),
    'Fabrikam', 'Lemons', 30, datetime(2018-10-03 05:00),
    'Contoso', 'Bananas', 12, datetime(2018-10-03 06:00),
    'Contoso', 'Bananas', 12, datetime(2018-10-04 07:00),
    'Contoso', 'Lemons', 29, datetime(2018-10-04 08:00),
    'Contoso', 'Grapes', 200, datetime(2018-10-05 09:00),
];
ProductsTable
| summarize Price = arg_min(Price, *) by Supplier, Fruit
| order by Supplier asc, Fruit asc, Price asc

Answer 2

我是 Kusto 的新手，但我发现下面可以通过使用 partition by 和 row_number( ) 在库斯托。

KQL:

let ProductsTable = datatable(Supplier: string, Fruit: string, Price: int, Purchase: datetime) 
[
    'Contoso', 'Grapes', 220, datetime(2018-10-01 01:00),
    'Fabrikam', 'Lemons', 31, datetime(2018-10-01 02:00),
    'Contoso', 'Lemons', 29, datetime(2018-10-02 03:00),
    'Contoso', 'Grapes', 210, datetime(2018-10-02 04:00),
    'Fabrikam', 'Lemons', 30, datetime(2018-10-03 05:00),
    'Contoso', 'Bananas', 12, datetime(2018-10-03 06:00),
    'Contoso', 'Bananas', 12, datetime(2018-10-04 07:00),
    'Contoso', 'Lemons', 29, datetime(2018-10-04 08:00),
    'Contoso', 'Grapes', 200, datetime(2018-10-05 09:00), 
]; 
ProductsTable 
| partition by Fruit 
  ( sort by Price asc   
    | extend rn = row_number(1, prev(Supplier) != Supplier)   
    | where rn == 1
  ) 
| project Supplier, Fruit, Price, Purchase 
| sort by Supplier asc, Fruit asc;

结果：

Supplier    Fruit   Price   Purchase
Contoso     Bananas 12      2018-10-03 06:00:00.0000000
Contoso     Grapes  200     2018-10-05 09:00:00.0000000
Contoso     Lemons  29      2018-10-02 03:00:00.0000000
Fabrikam    Lemons  30      2018-10-03 05:00:00.0000000

但是，这不如 Yoni L 的解决方案有效。我习惯于使用 Redshift/PostgreSQL 编写类似的查询，所以我想知道这是否可以通过 row_num() 这是一个非常常见的 window 函数来完成。

Kusto：如何从不参与 SUMMARIZE 的列中获取值？

Kusto: How can I get the value from the column that doesn't participate in a SUMMARIZE?

azure-log-analytics

azure-data-explorer