Azure analytics kusto 查询：如何按 2 个条件分组？

Question

我正在为移动应用程序使用 Azure 分析。我有主要应用程序页面的自定义事件 - 我可以在 customEvents table 中找到。

我是 kusto 的新手，所以使用示例我发现了以下查询：

let start = startofday(ago(28d));
let events = union customEvents, pageViews
| where timestamp >= start
| where name in ('*') or '*' in ('*') or ('%' in ('*') and itemType == 'pageView') or ('#' in ('*') 
and itemType == 'customEvent')
| extend Dim1 = tostring(name);
let overall = events |  summarize Users = dcount(user_Id);
let allUsers = toscalar(overall);
events
| summarize Users = dcount(user_Id), Sessions = dcount(session_Id), Instances = count() by Dim1
| extend DisplayDim = strcat(' ', Dim1)
| order by Users desc
| project Dim1, DisplayDim, Users, Sessions, Instances
| project ['Activities'] = DisplayDim, Values = Dim1, ['Active Users'] = Users, ['Unique Sessions'] = Sessions, ['Total Instances'] = Instances

查询运行良好，但我希望所有页面事件按 client_CountryOrRegion

分组

有什么方法可以按 client_CountryOrRegion 拆分吗？

Answer 1

不确定这是否是您要查找的内容，但如果您希望将结果拆分为 client_CountryOrRegion，您可以按该列进行汇总以及：

let start = startofday(ago(28d));
let events = union customEvents, pageViews
| where timestamp >= start
| where name in ('*') or '*' in ('*') or ('%' in ('*') and itemType == 'pageView') or ('#' in ('*') 
and itemType == 'customEvent')
| extend Dim1 = tostring(name);
let overall = events |  summarize Users = dcount(user_Id);
let allUsers = toscalar(overall);
events
| summarize Users = dcount(user_Id), Sessions = dcount(session_Id), Instances = count() by Dim1, client_CountryOrRegion
| extend DisplayDim = strcat(' ', Dim1)
| order by Users desc
| project Dim1, DisplayDim, Users, Sessions, Instances
| project ['Activities'] = DisplayDim, Values = Dim1, ['Active Users'] = Users, ['Unique Sessions'] = Sessions, ['Total Instances'] = Instances, client_CountryOrRegion

变化在这里：

summarize Users = dcount(user_Id), Sessions = dcount(session_Id), Instances = count() by Dim1 , client_CountryOrRegion