如何在天蓝色中检索对应于另一个 属性 的自定义 属性

Question

我正在尝试编写一个 kusto 查询来检索自定义 属性，如下所示。

我想检索 pkgName 和对应的 organization 的计数。我可以检索 pkgName 的计数，代码附在下面。

let mainTable = union customEvents
    | extend name =replace("\n", "", name)
    | where iif('*' in ("*"), 1 == 1, name in ("*"))
    | where true;
let queryTable = mainTable;
let cohortedTable = queryTable
    | extend dimension = customDimensions["pkgName"]
    | extend dimension = iif(isempty(dimension), "<undefined>", dimension)
    | summarize hll = hll(itemId) by tostring(dimension)
    | extend Events = dcount_hll(hll)
    | order by Events desc
    | serialize rank = row_number()
    | extend dimension = iff(rank > 10, 'Other', dimension)
    | summarize merged = hll_merge(hll) by tostring(dimension)
    | project ['pkgName'] = dimension, Counts = dcount_hll(merged);
cohortedTable

请帮助我获得 organization 以及每个 pkgName 投影。

Answer 1

请尝试这个简单的查询：

customEvents
| summarize counts=count(tostring(customDimensions.pkgName)) by pkgName=tostring(customDimensions.pkgName),organization=tostring(customDimensions.organization)

请随时修改以满足您的要求。

如果以上不满足您的要求，请尝试创建另一个包含pkgName和organization关系的table。然后使用 join 运算符连接这些 table。例如：

    //create a table which contains the relationship
    let temptable = customEvents
    | summarize by pkgName=tostring(customDimensions.pkgName),organization=tostring(customDimensions.organization);
    
    //then use the join operator to join these tables on the keyword pkgName.