如何访问 `range()` 语句中使用的 `toscalar()` 语句中的范围步长值

Question

我正在使用 Kusto 查询在 Azure AppInsights 中创建时间表，以使用 Google's examples of measuring if a webservice is within its error budget:

之一可视化我们的 Web 服务何时在其 SLO 内（以及何时不在）

SLI = The proportion of sufficiently fast requests, as measured from the load balancer metrics. “Sufficiently fast” is defined as < 400 ms.
SLO = 90% of requests < 400 ms

Measured as:
count of http_requests with a duration less than or equal to "0.4" seconds
divided by count of all http_requests

假设在 7 天内检查间隔为 10 分钟 window，这是我的代码：

let fastResponseTimeMaxMs = 400.0;
let errorBudgetThresholdForFastResponseTime = 90.0;
//
let startTime = ago(7days);
let endTime = now();
let timeStep = 10m;
//
let timeRange = range InspectionTime from startTime to endTime step timeStep;
timeRange
    | extend RespTimeMax_ms = fastResponseTimeMaxMs
    | extend ActualCount = toscalar
    (
        requests
            | where timestamp > InspectionTime - timeStep
            | where timestamp <= InspectionTime
            | where success == "True"
            | where duration <= fastResponseTimeMaxMs
            | count 
    )
    | extend TotalCount = toscalar
    (
        requests 
            | where timestamp > InspectionTime - timeStep
            | where timestamp <= InspectionTime
            | where success == "True"
            | count
    )
    | extend Percentage = round(todecimal(ActualCount * 100) / todecimal(TotalCount), 2)
    | extend ErrorBudgetMinPercent = errorBudgetThresholdForFastResponseTime
    | extend InBudget = case(Percentage >= ErrorBudgetMinPercent, 1, 0)

我希望实现的示例查询输出：

InspectionTime [UTC]     RespTimeMax_ms  ActualCount  TotalCount  Percentage  ErrorBudgetMinPercent  InBudget
2019-05-23T21:53:17.894  400             8,098        8,138       99.51       90                     1  
2019-05-23T22:03:17.894  400             8,197        9,184       89.14       90                     0  
2019-05-23T22:13:17.894  400             8,002        8,555       93.54       90                     1

我得到的错误是：

'where' operator: Failed to resolve scalar expression named 'InspectionTime'

我试过 todatetime(InspectionTime)，失败并出现同样的错误。

将 InspectionTime 替换为 datetime 类型的其他对象可以使此代码执行正常，但不是我想要的日期时间值。例如，当在我上面的代码示例中使用时，使用此代码段执行 OK：

   | extend ActualCount = toscalar
    (
        requests
            | where timestamp > startTime   // instead of 'InspectionTime - timeStep'
            | where timestamp <= endTime    // instead of 'InspectionTime'
            | where duration <= fastResponseTimeMaxMs
            | count   
    )

对我来说，在 toscalar(...) 中使用 InspectionTime 似乎是这个问题的关键，因为我能够在使用 range(...) 的类似查询中使用 InspectionTime不将其嵌套在 toscalar(...).

中

注意：我不想要 request.duration 的时间图表，因为它不会告诉我请求数是否超过我的阈值（400 毫秒）根据上面定义的公式超出我们的误差预算。

Answer 1

您的查询无效，因为您无法引用您在 toscalar() 中运行的子查询中的 InspectionTime 列。

如果我正确理解了您所需的逻辑，则以下查询可能会起作用或为您提供不同的方向（如果不能 - 您可能希望使用 datatable 运算符共享示例输入数据集，并指定所需的匹配的结果）

let fastResponseTimeMaxMs = 400.0;
let errorBudgetThresholdForFastResponseTime = 90.0;
//
let startTime = ago(7days);
let endTime = now();
let timeStep = 10m;
//
requests
| where timestamp > startTime and timestamp < endTime
| where success == 'True'
| summarize TotalCount = count(), ActualCount = countif(duration <= fastResponseTimeMaxMs) by bin(timestamp, timeStep)
| extend Percentage = round(todecimal(ActualCount * 100) / todecimal(TotalCount), 2)
| extend ErrorBudgetMinPercent = errorBudgetThresholdForFastResponseTime
| extend InBudget = case(Percentage >= ErrorBudgetMinPercent, 1, 0)

如何访问 `range()` 语句中使用的 `toscalar()` 语句中的范围步长值

How to access the range-step value within `toscalar()` statement used within `range()` statement

azure-application-insights

azure-data-explorer

azure-analytics

kql