与 "in" 条件一起使用的表格类型
Tabular type used with "in" condition
如何在 in
条件语句中使用表格类型?请参阅下面第二个查询中的最后一个条件:Computer in clusterNodes
。我收到以下语法错误:
Query could not be parsed at 'in' on line [9,181]
Token: in Line: 9 Position: 181
let clusterNodes =
KubeNodeInventory
| where TimeGenerated > ago(7d)
| where ClusterName == "test-aks"
| distinct Computer;
Perf
| where TimeGenerated > ago(1d)
| where CounterName == "cpuUsageNanoCores" and ObjectName == "K8SNode" and Computer in clusterNodes
| summarize ValueAvg = avg(CounterValue) by Time = bin(TimeGenerated, 15m), Counter = CounterName
| project round(ValueAvg / 1000000000, 2), Time, Counter
| render timechart;
以下应该有助于在这种情况下利用 in:
| where … and Computer in (clusterNodes)
P.S。您可能还需要删除 let 和查询的其余部分之间的空行(取决于您如何 select 中的查询UI 执行)。
如何在 in
条件语句中使用表格类型?请参阅下面第二个查询中的最后一个条件:Computer in clusterNodes
。我收到以下语法错误:
Query could not be parsed at 'in' on line [9,181]
Token: in Line: 9 Position: 181
let clusterNodes =
KubeNodeInventory
| where TimeGenerated > ago(7d)
| where ClusterName == "test-aks"
| distinct Computer;
Perf
| where TimeGenerated > ago(1d)
| where CounterName == "cpuUsageNanoCores" and ObjectName == "K8SNode" and Computer in clusterNodes
| summarize ValueAvg = avg(CounterValue) by Time = bin(TimeGenerated, 15m), Counter = CounterName
| project round(ValueAvg / 1000000000, 2), Time, Counter
| render timechart;
以下应该有助于在这种情况下利用 in:
| where … and Computer in (clusterNodes)
P.S。您可能还需要删除 let 和查询的其余部分之间的空行(取决于您如何 select 中的查询UI 执行)。