在 kusto (kql) 中使用其他聚合列 (count()) 时如何将 max(timestamp) 与 summarize 一起使用？

Question

我正在尝试在 kusto (kql) 中编写一个查询，我将在其中检查哪些用户访问了哪些项目的次数。

pageViews
| extend projectId = extract(@"/projects/([0-9a-f]{32}|[0-9a-zA-Z]{21,22})", 1, url)
| where url matches regex @'/projects/([0-9a-f]{32}|[0-9a-zA-Z]{21,22})' 
and timestamp > ago(90d)
and isnotempty(user_Id)
| project timestamp, user_AccountId, user_Id, url, projectId
| summarize projectRequests = count() by  user_Id, projectId

我需要在最后一次访问之前扩展此功能

我试过了：

pageViews
| extend projectId = extract(@"/projects/([0-9a-f]{32}|[0-9a-zA-Z]{21,22})", 1, url)
| where url matches regex @'/projects/([0-9a-f]{32}|[0-9a-zA-Z]{21,22})' 
and timestamp > ago(90d)
and isnotempty(user_Id)
| project timestamp, user_AccountId, user_Id, url, projectId
| summarize projectRequests = count() by  user_Id, projectId, LastEdit = max(timestamp)

但它给了我

Function 'max' cannot be invoked in current context

我如何扩展此查询以包括上次访问项目的时间？

Answer 1

我不得不翻转 LastEdit = max(timestamp) 和 ProjectRequests = count() by user_Id, projectId。

喜欢：

pageViews
| extend projectId = extract(@"/projects/([0-9a-f]{32}|[0-9a-zA-Z]{21,22})", 1, url)
| where url matches regex @'/projects/([0-9a-f]{32}|[0-9a-zA-Z]{21,22})' 
and timestamp > ago(90d)
and isnotempty(user_Id)
| project timestamp, user_AccountId, user_Id, url, projectId
| summarize LastEdit = max(timestamp), ProjectRequests = count() by  user_Id, projectId

Answer 2

你应该替换：

| summarize projectRequests = count() by user_Id, projectId, LastEdit = max(timestamp)

和

| summarize projectRequests = count(), LastEdit = max(timestamp) by user_Id, projectId

在 kusto (kql) 中使用其他聚合列 (count()) 时如何将 max(timestamp) 与 summarize 一起使用？

How to use max(timestamp) with summarize when using other aggregated columns (count()) in kusto (kql)?

max

azure-log-analytics

kql