在 KQL 中按属性聚合数据
Aggregate data by properties in KQL
这个问题是 的延续
我正在从事一个项目,目标是将荷兰的多家银行连接到我们的平台。
每次用户连接到一家银行时,我们都希望发送一个指标并将其显示在 Azure 仪表板中。我们已经在做,但我们想扩展它的功能。
customMetrics
| where name == "CustomerGrantedConsent" and customDimensions.IsInitialConsent == "True"
| extend BankName = customDimensions.BankName
| summarize Count = count() by tostring(BankName), bin(timestamp, 1d)
| order by BankName asc, timestamp asc
| serialize FirstConsents = row_cumsum(Count, BankName != prev(BankName))
通过此查询,我们能够在银行同意发生时汇总它们的总和。这是迄今为止的结果。如您所见, ,我们希望将金额与时间相加。
我的意思是,如果昨天我们有 4 个同意,今天的总数将是:
yesterday_count + today_count
4 + today_count
现在,如果今天没有同意,我们就不会显示前一天的总和,这就是问题所在。
如果昨天,我们对 BUNQ 有 4 个同意,今天我想至少显示 4 个:
- BUNQ 有 4 个连接 31-01-2021
- 今天 BUNQ 总共至少有 4 个连接..
我们如何做到这一点?
您需要使用 make-series
而不是 summarize
才能获得 0
。方法如下:
datatable(Timestamp: datetime, BankName: string) [
datetime(2021-01-29 08:00:00), "ABN AMRO",
datetime(2021-01-29 09:00:00), "ABN AMRO",
datetime(2021-01-28 09:00:00), "Invers",
datetime(2021-01-28 10:00:00), "Invers",
datetime(2021-01-28 11:00:00), "Invers",
datetime(2021-01-29 08:00:00), "Invers",
datetime(2021-01-29 09:00:00), "Invers",
]
| make-series Count = count() on Timestamp to now() step 1d by tostring(BankName)
| mv-expand Count to typeof(long), Timestamp to typeof(string)
| order by BankName asc, Timestamp asc
| extend FirstConsents = row_cumsum(Count, BankName != prev(BankName))
输出将是:
BankName
Count
Timestamp
FirstConsents
ABN AMRO
2
2021-01-28 11:12:50
2
ABN AMRO
0
2021-01-29 11:12:50
2
ABN AMRO
0
2021-01-30 11:12:50
2
ABN AMRO
0
2021-01-31 11:12:50
2
Invers
3
2021-01-27 11:12:50
3
Invers
2
2021-01-28 11:12:50
5
Invers
0
2021-01-29 11:12:50
5
Invers
0
2021-01-30 11:12:50
5
Invers
0
2021-01-31 11:12:50
5
这个问题是
每次用户连接到一家银行时,我们都希望发送一个指标并将其显示在 Azure 仪表板中。我们已经在做,但我们想扩展它的功能。
customMetrics
| where name == "CustomerGrantedConsent" and customDimensions.IsInitialConsent == "True"
| extend BankName = customDimensions.BankName
| summarize Count = count() by tostring(BankName), bin(timestamp, 1d)
| order by BankName asc, timestamp asc
| serialize FirstConsents = row_cumsum(Count, BankName != prev(BankName))
通过此查询,我们能够在银行同意发生时汇总它们的总和。这是迄今为止的结果。如您所见, ,我们希望将金额与时间相加。
我的意思是,如果昨天我们有 4 个同意,今天的总数将是:
yesterday_count + today_count
4 + today_count
现在,如果今天没有同意,我们就不会显示前一天的总和,这就是问题所在。 如果昨天,我们对 BUNQ 有 4 个同意,今天我想至少显示 4 个:
- BUNQ 有 4 个连接 31-01-2021
- 今天 BUNQ 总共至少有 4 个连接..
我们如何做到这一点?
您需要使用 make-series
而不是 summarize
才能获得 0
。方法如下:
datatable(Timestamp: datetime, BankName: string) [
datetime(2021-01-29 08:00:00), "ABN AMRO",
datetime(2021-01-29 09:00:00), "ABN AMRO",
datetime(2021-01-28 09:00:00), "Invers",
datetime(2021-01-28 10:00:00), "Invers",
datetime(2021-01-28 11:00:00), "Invers",
datetime(2021-01-29 08:00:00), "Invers",
datetime(2021-01-29 09:00:00), "Invers",
]
| make-series Count = count() on Timestamp to now() step 1d by tostring(BankName)
| mv-expand Count to typeof(long), Timestamp to typeof(string)
| order by BankName asc, Timestamp asc
| extend FirstConsents = row_cumsum(Count, BankName != prev(BankName))
输出将是:
BankName | Count | Timestamp | FirstConsents |
---|---|---|---|
ABN AMRO | 2 | 2021-01-28 11:12:50 | 2 |
ABN AMRO | 0 | 2021-01-29 11:12:50 | 2 |
ABN AMRO | 0 | 2021-01-30 11:12:50 | 2 |
ABN AMRO | 0 | 2021-01-31 11:12:50 | 2 |
Invers | 3 | 2021-01-27 11:12:50 | 3 |
Invers | 2 | 2021-01-28 11:12:50 | 5 |
Invers | 0 | 2021-01-29 11:12:50 | 5 |
Invers | 0 | 2021-01-30 11:12:50 | 5 |
Invers | 0 | 2021-01-31 11:12:50 | 5 |