如何在 kusto/appinsight 连接中使用 where 条件
How to use where condition in a kusto/appinsight join
我正在努力实现这些目标:
- 获取某些字段的最新数据(基于时间戳)-> 调用此 latestRequest
- 获取这些字段的先前数据(基本上是时间戳 < latestRequest.timestamp)-> 调用此 previousRequest
- 统计latestRequest和previousRequest的区别
这是我现在带来的:
let LatestRequest=requests
| where operation_Name == "SearchServiceFieldMonitor"
| extend Mismatch = split(tostring(customDimensions.IndexerMismatch), " in ")
| extend difference = toint(Mismatch[0])
, field = tostring(Mismatch[1])
, indexer = tostring(Mismatch[2])
, index = tostring(Mismatch[3])
, service = tostring(Mismatch[4])
| summarize MaxTime=todatetime(max(timestamp)) by service,index,indexer;
let previousRequest = requests
| where operation_Name == "SearchServiceFieldMonitor"
| extend Mismatch = split(tostring(customDimensions.IndexerMismatch), " in ")
| extend difference = toint(Mismatch[0])
, field = tostring(Mismatch[1])
, indexer = tostring(Mismatch[2])
, index = tostring(Mismatch[3])
, service = tostring(Mismatch[4])
|join (LatestRequest) on indexer, index,service
|where timestamp <LatestRequest.MaxTime
但是,我从这个查询中得到这个错误:
Ensure that expression: LatestRequest.MaxTime is indeed a simple name
我尝试使用 toDateTime(LatestRequest.MaxTime)
,但没有任何区别。我做错了什么?
你得到的错误是因为你不能使用点符号引用 table 中的列,你应该简单地使用列名,因为连接运算符的结果是 table 与连接两侧的适用列。
加入的替代方法可能是使用 row_number() and prev() 函数。您可以通过根据键和时间戳对行进行排序来找到最后一条记录和它之前的记录,然后计算当前行和它之前的行之间的值。
这是一个例子:
datatable(timestamp:datetime, requestId:int, val:int)
[datetime(2021-02-20 10:00), 1, 5,
datetime(2021-02-20 11:00), 1, 6,
datetime(2021-02-20 12:00), 1, 8,
datetime(2021-02-20 10:00), 2, 10,
datetime(2021-02-20 11:00), 2, 20,
datetime(2021-02-20 12:00), 2, 30,
datetime(2021-02-20 13:00), 2, 40,
datetime(2021-02-20 13:00), 3, 100
]
| order by requestId asc, timestamp desc
| extend rn = row_number(0, requestId !=prev(requestId))
| where rn <= 1
| order by requestId, rn desc
| extend diff = iif(prev(rn) == 1, val - prev(val), val)
| where rn == 0
| project-away rn
结果是:
我正在努力实现这些目标:
- 获取某些字段的最新数据(基于时间戳)-> 调用此 latestRequest
- 获取这些字段的先前数据(基本上是时间戳 < latestRequest.timestamp)-> 调用此 previousRequest
- 统计latestRequest和previousRequest的区别
这是我现在带来的:
let LatestRequest=requests
| where operation_Name == "SearchServiceFieldMonitor"
| extend Mismatch = split(tostring(customDimensions.IndexerMismatch), " in ")
| extend difference = toint(Mismatch[0])
, field = tostring(Mismatch[1])
, indexer = tostring(Mismatch[2])
, index = tostring(Mismatch[3])
, service = tostring(Mismatch[4])
| summarize MaxTime=todatetime(max(timestamp)) by service,index,indexer;
let previousRequest = requests
| where operation_Name == "SearchServiceFieldMonitor"
| extend Mismatch = split(tostring(customDimensions.IndexerMismatch), " in ")
| extend difference = toint(Mismatch[0])
, field = tostring(Mismatch[1])
, indexer = tostring(Mismatch[2])
, index = tostring(Mismatch[3])
, service = tostring(Mismatch[4])
|join (LatestRequest) on indexer, index,service
|where timestamp <LatestRequest.MaxTime
但是,我从这个查询中得到这个错误:
Ensure that expression: LatestRequest.MaxTime is indeed a simple name
我尝试使用 toDateTime(LatestRequest.MaxTime)
,但没有任何区别。我做错了什么?
你得到的错误是因为你不能使用点符号引用 table 中的列,你应该简单地使用列名,因为连接运算符的结果是 table 与连接两侧的适用列。
加入的替代方法可能是使用 row_number() and prev() 函数。您可以通过根据键和时间戳对行进行排序来找到最后一条记录和它之前的记录,然后计算当前行和它之前的行之间的值。
这是一个例子:
datatable(timestamp:datetime, requestId:int, val:int)
[datetime(2021-02-20 10:00), 1, 5,
datetime(2021-02-20 11:00), 1, 6,
datetime(2021-02-20 12:00), 1, 8,
datetime(2021-02-20 10:00), 2, 10,
datetime(2021-02-20 11:00), 2, 20,
datetime(2021-02-20 12:00), 2, 30,
datetime(2021-02-20 13:00), 2, 40,
datetime(2021-02-20 13:00), 3, 100
]
| order by requestId asc, timestamp desc
| extend rn = row_number(0, requestId !=prev(requestId))
| where rn <= 1
| order by requestId, rn desc
| extend diff = iif(prev(rn) == 1, val - prev(val), val)
| where rn == 0
| project-away rn
结果是: