如果 Term 达到某个点，Kusto row_cumsum 修改 Term

Question

我有一份员工姓名和薪水的列表，顺序如下

我需要按以下格式创建输出 table。即，每当累计工资总额超过 3000 时，我必须检测到并标记该行。

我尝试过 row_cumsum 并在 Term 超过 3000 后重置它，但它在第二次迭代中不起作用。

datatable (name:string, month:int, salary:long)
[
    "Alice", 1, 1000,
    "Alice", 2, 2000,
    "Alice", 3, 1400,
    "Alice", 3, 1400,
    "Alice", 3, 1400,
]
| order by name asc, month asc
| extend total=row_cumsum(salary) 
| extend total=iff(total >=3000,total-prev(total),total)

Answer 1

现在可以使用 scan operator:

datatable (name:string, salary:long)
[
    "Alice", 1000,
    "Alice", 2000,
    "Alice", 1400,
    "Alice", 1400,
    "Alice", 1400,
    "Alice", 1000,
    "Bob", 2400,
    "Bob", 1000,
    "Bob", 1000
]
| sort by name asc
| scan declare (total:long) with 
(
    step s: true => total = iff(isnull(s.total) or name != s.name, salary, iff(s.total < 3000, s.total + salary, salary));
)
| extend boundary_detected = iff(total >= 3000, 1, long(null))

name	salary	total	boundary_detected
Alice	1000	1000
Alice	2000	3000	1
Alice	1400	1400
Alice	1400	2800
Alice	1400	4200	1
Alice	1000	1000
Bob	2400	2400
Bob	1000	3400	1
Bob	1000	1000

如果 Term 达到某个点，Kusto row_cumsum 修改 Term

Kusto row_cumsum modifying the Term if Term reaches a point

azure-data-explorer

kql

adx