KUSTO：多拆分查询中的阈值线

Question

我想在 KUSTO 查询中显示特定值的阈值。我认为我看起来很简单但不起作用，当您的查询在摘要中使用多个 'by' 子句时。

这有效，该行显示在 4500:

customEvents
 | where name == "Event sharepoint monitoring script" 
 | where timestamp >= ago(14d)
 | extend spRequestDuration = customDimensions.["spRequestDuration"]    
 | summarize avgRequestDuration=avg(todouble(spRequestDuration)), threshold = 4500 by bin(timestamp, 5m) // use a time grain of 5 minutes
 | render timechart

但是对于下面的查询，没有显示额外的阈值线。

customEvents
 | where name == "Event sharepoint monitoring script" 
 | where timestamp >= ago(14d)
 | extend spRequestDuration = customDimensions.["spRequestDuration"]  
 | extend siteType = customDimensions.["SiteType"] 
 | summarize avgRequestDuration=avg(todouble(spRequestDuration)), threshold = 4500 by tostring(siteType), bin(timestamp, 5m) // use a time grain of 5 minutes
 | render timechart

我应该用不同的方式来做，还是不支持？

Answer 1

您需要将 "threshold" 创建为一个单独的附加 "siteType" 系列，一种方法是与另一个仅包含 "threshold" 的数据集合并一个自己的网站。这是一个例子：

let events = customEvents
 | where name == "Event sharepoint monitoring script" 
 | where timestamp >= ago(14d)
 | extend spRequestDuration = customDimensions.["spRequestDuration"]
 | extend siteType = customDimensions.["SiteType"];
 events
 | summarize avgRequestDuration=avg(todouble(spRequestDuration)) by tostring(siteType), bin(timestamp, 5m) // use a time grain of 5 minutes
 | union (events | summarize by bin(timestamp, 5m), siteType="Threshold" | extend avgRequestDuration = 4500.0)
 | render timechart

KUSTO：多拆分查询中的阈值线

KUSTO: Threshold line in multiple split query

azure-application-insights

kql

azure-data-explorer