Kusto 中 OperationName 的开始和结束时间？
Start and End Times by OperationName in Kusto?
如何为下面示例中的每个 OperationName 添加 StartTime 和 EndTime？
示例数据：
datatable(TimeGenerated:datetime, OperationName:string, ChunkSize:string, StatusCode:string, Filename:string, UserAgent:string)
[
datetime(2021-05-27T06:03:59.5708689Z), "CreateFilePath", "0MB", "201", "test_file.csv", "Microsoft Azure Storage Explorer",
datetime(2021-05-27T06:04:03.3834404Z), "LeaseFile", "0MB", "201", "test_file.csv", "Microsoft Azure Storage Explorer",
datetime(2021-05-27T06:05:06.1334979Z), "AppendFile", "8MB", "206", "test_file.csv", "Microsoft Azure Storage Explorer",
datetime(2021-05-27T06:05:07.1334979Z), "AppendFile", "8MB", "206", "test_file.csv", "Microsoft Azure Storage Explorer",
datetime(2021-05-27T06:05:08.1334979Z), "AppendFile", "8MB", "206", "test_file.csv", "Microsoft Azure Storage Explorer",
datetime(2021-05-27T06:05:09.1334979Z), "AppendFile", "8MB", "206", "test_file.csv", "Microsoft Azure Storage Explorer",
datetime(2021-05-27T06:05:10.1334979Z), "AppendFile", "8MB", "206", "test_file.csv", "Microsoft Azure Storage Explorer",
datetime(2021-05-27T06:05:11.1334979Z), "AppendFile", "8MB", "206", "test_file.csv", "Microsoft Azure Storage Explorer",
datetime(2021-05-27T06:05:12.1334979Z), "AppendFile", "8MB", "206", "test_file.csv", "Microsoft Azure Storage Explorer",
datetime(2021-05-27T06:05:13.1334979Z), "FlushFile", "0MB", "200", "test_file.csv", "Microsoft Azure Storage Explorer",
datetime(2021-05-27T06:05:14.1334979Z), "LeaseFile", "0MB", "200", "test_file.csv", "Microsoft Azure Storage Explorer",
datetime(2021-05-27T06:05:15.1334979Z), "GetBlob", "256MB", "206", "test_file.csv", "azsdk-python-storage-blob/12.8.1 Python/3.8.10",
datetime(2021-05-27T06:05:16.1334979Z), "GetBlob", "128MB", "206", "test_file.csv", "azsdk-python-storage-blob/12.8.1 Python/3.8.10",
datetime(2021-05-27T06:05:17.1334979Z), "GetBlob", "128MB", "206", "test_file.csv", "azsdk-python-storage-blob/12.8.1 Python/3.8.10",
datetime(2021-05-27T06:05:18.1334979Z), "GetBlob", "128MB", "206", "test_file.csv", "azsdk-python-storage-blob/12.8.1 Python/3.8.10",
datetime(2021-05-27T06:05:19.1334979Z), "GetBlob", "128MB", "206", "test_file.csv", "azsdk-python-storage-blob/12.8.1 Python/3.8.10",
datetime(2021-05-27T06:05:20.1334979Z), "GetBlob", "128MB", "206", "test_file.csv", "azsdk-python-storage-blob/12.8.1 Python/3.8.10"
]
| summarize MethodCount = count() by OperationName, Filename, UserAgent
结果：
OperationName FileName UserAgent MethodCount
CreateFilePath test_file.csv Microsoft Azure Storage Explorer 1
LeaseFile test_file.csv Microsoft Azure Storage Explorer 2
AppendFile test_file.csv Microsoft Azure Storage Explorer 7
FlushFile test_file.csv Microsoft Azure Storage Explorer 1
GetBlob test_file.csv azsdk-python-storage-blob/12.8.1 Python/3.8.10 6
需要：
StartTime EndTime OperationName FileName UserAgent MethodCount
2021-05-27T06:03:59.5708689Z 2021-05-27T06:03:59.5708689Z CreateFilePath test_file.csv Microsoft Azure Storage Explorer 1
2021-05-27T06:04:03.3834404Z 2021-05-27T06:05:14.1334979Z LeaseFile test_file.csv Microsoft Azure Storage Explorer 2
2021-05-27T06:05:06.1334979Z 2021-05-27T06:05:12.1334979Z AppendFile test_file.csv Microsoft Azure Storage Explorer 7
2021-05-27T06:05:13.1334979Z 2021-05-27T06:05:13.1334979Z FlushFile test_file.csv Microsoft Azure Storage Explorer 1
2021-05-27T06:05:15.1334979Z 2021-05-27T06:05:20.1334979Z GetBlob test_file.csv azsdk-python-storage-blob/12.8.1 Python/3.8.10 6
尝试过：
| summarize
StartTime = min(TimeGenerated) by OperationName,
EndTime = max(TimeGenerated) by OperationName`,
MethodCount = count() by OperationName,
Filename,
UserAgent
由于特定 OperationName 的所有记录的文件名值将相同，因此使用 summarize any(Filename) 从具有此 OperationName 的任何记录中获取值就足够了。与 UserAgent 列相同。
datatable(TimeGenerated:datetime, OperationName:string, ChunkSize:string, StatusCode:string, Filename:string, UserAgent:string)
[
datetime(2021-05-27T06:03:59.5708689Z), "CreateFilePath", "0MB", "201", "test_file.csv", "Microsoft Azure Storage Explorer",
datetime(2021-05-27T06:04:03.3834404Z), "LeaseFile", "0MB", "201", "test_file.csv", "Microsoft Azure Storage Explorer",
datetime(2021-05-27T06:05:06.1334979Z), "AppendFile", "8MB", "206", "test_file.csv", "Microsoft Azure Storage Explorer",
datetime(2021-05-27T06:05:07.1334979Z), "AppendFile", "8MB", "206", "test_file.csv", "Microsoft Azure Storage Explorer",
datetime(2021-05-27T06:05:08.1334979Z), "AppendFile", "8MB", "206", "test_file.csv", "Microsoft Azure Storage Explorer",
datetime(2021-05-27T06:05:09.1334979Z), "AppendFile", "8MB", "206", "test_file.csv", "Microsoft Azure Storage Explorer",
datetime(2021-05-27T06:05:10.1334979Z), "AppendFile", "8MB", "206", "test_file.csv", "Microsoft Azure Storage Explorer",
datetime(2021-05-27T06:05:11.1334979Z), "AppendFile", "8MB", "206", "test_file.csv", "Microsoft Azure Storage Explorer",
datetime(2021-05-27T06:05:12.1334979Z), "AppendFile", "8MB", "206", "test_file.csv", "Microsoft Azure Storage Explorer",
datetime(2021-05-27T06:05:13.1334979Z), "FlushFile", "0MB", "200", "test_file.csv", "Microsoft Azure Storage Explorer",
datetime(2021-05-27T06:05:14.1334979Z), "LeaseFile", "0MB", "200", "test_file.csv", "Microsoft Azure Storage Explorer",
datetime(2021-05-27T06:05:15.1334979Z), "GetBlob", "256MB", "206", "test_file.csv", "azsdk-python-storage-blob/12.8.1 Python/3.8.10",
datetime(2021-05-27T06:05:16.1334979Z), "GetBlob", "128MB", "206", "test_file.csv", "azsdk-python-storage-blob/12.8.1 Python/3.8.10",
datetime(2021-05-27T06:05:17.1334979Z), "GetBlob", "128MB", "206", "test_file.csv", "azsdk-python-storage-blob/12.8.1 Python/3.8.10",
datetime(2021-05-27T06:05:18.1334979Z), "GetBlob", "128MB", "206", "test_file.csv", "azsdk-python-storage-blob/12.8.1 Python/3.8.10",
datetime(2021-05-27T06:05:19.1334979Z), "GetBlob", "128MB", "206", "test_file.csv", "azsdk-python-storage-blob/12.8.1 Python/3.8.10",
datetime(2021-05-27T06:05:20.1334979Z), "GetBlob", "128MB", "206", "test_file.csv", "azsdk-python-storage-blob/12.8.1 Python/3.8.10"
]
| summarize StartTime=min(TimeGenerated), EndTime=max(TimeGenerated), Filename=any(Filename), UserAgent=any(UserAgent), MethodCount=count() by OperationName
| project-reorder StartTime, EndTime, OperationName, Filename, UserAgent, MethodCount
输出：
StartTime
EndTime
OperationName
Filename
UserAgent
MethodCount
2021-05-27 06:03:59.5708689
2021-05-27 06:03:59.5708689
CreateFilePath
test_file.csv
Microsoft Azure Storage Explorer
1
2021-05-27 06:04:03.3834404
2021-05-27 06:05:14.1334979
LeaseFile
test_file.csv
Microsoft Azure Storage Explorer
2
2021-05-27 06:05:06.1334979
2021-05-27 06:05:12.1334979
AppendFile
test_file.csv
Microsoft Azure Storage Explorer
7
2021-05-27 06:05:13.1334979
2021-05-27 06:05:13.1334979
FlushFile
test_file.csv
Microsoft Azure Storage Explorer
1
2021-05-27 06:05:15.1334979
2021-05-27 06:05:20.1334979
GetBlob
test_file.csv
azsdk-python-storage-blob/12.8.1 Python/3.8.10
6
如何为下面示例中的每个 OperationName 添加 StartTime 和 EndTime？
示例数据：
datatable(TimeGenerated:datetime, OperationName:string, ChunkSize:string, StatusCode:string, Filename:string, UserAgent:string)
[
datetime(2021-05-27T06:03:59.5708689Z), "CreateFilePath", "0MB", "201", "test_file.csv", "Microsoft Azure Storage Explorer",
datetime(2021-05-27T06:04:03.3834404Z), "LeaseFile", "0MB", "201", "test_file.csv", "Microsoft Azure Storage Explorer",
datetime(2021-05-27T06:05:06.1334979Z), "AppendFile", "8MB", "206", "test_file.csv", "Microsoft Azure Storage Explorer",
datetime(2021-05-27T06:05:07.1334979Z), "AppendFile", "8MB", "206", "test_file.csv", "Microsoft Azure Storage Explorer",
datetime(2021-05-27T06:05:08.1334979Z), "AppendFile", "8MB", "206", "test_file.csv", "Microsoft Azure Storage Explorer",
datetime(2021-05-27T06:05:09.1334979Z), "AppendFile", "8MB", "206", "test_file.csv", "Microsoft Azure Storage Explorer",
datetime(2021-05-27T06:05:10.1334979Z), "AppendFile", "8MB", "206", "test_file.csv", "Microsoft Azure Storage Explorer",
datetime(2021-05-27T06:05:11.1334979Z), "AppendFile", "8MB", "206", "test_file.csv", "Microsoft Azure Storage Explorer",
datetime(2021-05-27T06:05:12.1334979Z), "AppendFile", "8MB", "206", "test_file.csv", "Microsoft Azure Storage Explorer",
datetime(2021-05-27T06:05:13.1334979Z), "FlushFile", "0MB", "200", "test_file.csv", "Microsoft Azure Storage Explorer",
datetime(2021-05-27T06:05:14.1334979Z), "LeaseFile", "0MB", "200", "test_file.csv", "Microsoft Azure Storage Explorer",
datetime(2021-05-27T06:05:15.1334979Z), "GetBlob", "256MB", "206", "test_file.csv", "azsdk-python-storage-blob/12.8.1 Python/3.8.10",
datetime(2021-05-27T06:05:16.1334979Z), "GetBlob", "128MB", "206", "test_file.csv", "azsdk-python-storage-blob/12.8.1 Python/3.8.10",
datetime(2021-05-27T06:05:17.1334979Z), "GetBlob", "128MB", "206", "test_file.csv", "azsdk-python-storage-blob/12.8.1 Python/3.8.10",
datetime(2021-05-27T06:05:18.1334979Z), "GetBlob", "128MB", "206", "test_file.csv", "azsdk-python-storage-blob/12.8.1 Python/3.8.10",
datetime(2021-05-27T06:05:19.1334979Z), "GetBlob", "128MB", "206", "test_file.csv", "azsdk-python-storage-blob/12.8.1 Python/3.8.10",
datetime(2021-05-27T06:05:20.1334979Z), "GetBlob", "128MB", "206", "test_file.csv", "azsdk-python-storage-blob/12.8.1 Python/3.8.10"
]
| summarize MethodCount = count() by OperationName, Filename, UserAgent
结果：
OperationName FileName UserAgent MethodCount
CreateFilePath test_file.csv Microsoft Azure Storage Explorer 1
LeaseFile test_file.csv Microsoft Azure Storage Explorer 2
AppendFile test_file.csv Microsoft Azure Storage Explorer 7
FlushFile test_file.csv Microsoft Azure Storage Explorer 1
GetBlob test_file.csv azsdk-python-storage-blob/12.8.1 Python/3.8.10 6
需要：
StartTime EndTime OperationName FileName UserAgent MethodCount
2021-05-27T06:03:59.5708689Z 2021-05-27T06:03:59.5708689Z CreateFilePath test_file.csv Microsoft Azure Storage Explorer 1
2021-05-27T06:04:03.3834404Z 2021-05-27T06:05:14.1334979Z LeaseFile test_file.csv Microsoft Azure Storage Explorer 2
2021-05-27T06:05:06.1334979Z 2021-05-27T06:05:12.1334979Z AppendFile test_file.csv Microsoft Azure Storage Explorer 7
2021-05-27T06:05:13.1334979Z 2021-05-27T06:05:13.1334979Z FlushFile test_file.csv Microsoft Azure Storage Explorer 1
2021-05-27T06:05:15.1334979Z 2021-05-27T06:05:20.1334979Z GetBlob test_file.csv azsdk-python-storage-blob/12.8.1 Python/3.8.10 6
尝试过：
| summarize
StartTime = min(TimeGenerated) by OperationName,
EndTime = max(TimeGenerated) by OperationName`,
MethodCount = count() by OperationName,
Filename,
UserAgent
由于特定 OperationName 的所有记录的文件名值将相同，因此使用 summarize any(Filename) 从具有此 OperationName 的任何记录中获取值就足够了。与 UserAgent 列相同。
datatable(TimeGenerated:datetime, OperationName:string, ChunkSize:string, StatusCode:string, Filename:string, UserAgent:string)
[
datetime(2021-05-27T06:03:59.5708689Z), "CreateFilePath", "0MB", "201", "test_file.csv", "Microsoft Azure Storage Explorer",
datetime(2021-05-27T06:04:03.3834404Z), "LeaseFile", "0MB", "201", "test_file.csv", "Microsoft Azure Storage Explorer",
datetime(2021-05-27T06:05:06.1334979Z), "AppendFile", "8MB", "206", "test_file.csv", "Microsoft Azure Storage Explorer",
datetime(2021-05-27T06:05:07.1334979Z), "AppendFile", "8MB", "206", "test_file.csv", "Microsoft Azure Storage Explorer",
datetime(2021-05-27T06:05:08.1334979Z), "AppendFile", "8MB", "206", "test_file.csv", "Microsoft Azure Storage Explorer",
datetime(2021-05-27T06:05:09.1334979Z), "AppendFile", "8MB", "206", "test_file.csv", "Microsoft Azure Storage Explorer",
datetime(2021-05-27T06:05:10.1334979Z), "AppendFile", "8MB", "206", "test_file.csv", "Microsoft Azure Storage Explorer",
datetime(2021-05-27T06:05:11.1334979Z), "AppendFile", "8MB", "206", "test_file.csv", "Microsoft Azure Storage Explorer",
datetime(2021-05-27T06:05:12.1334979Z), "AppendFile", "8MB", "206", "test_file.csv", "Microsoft Azure Storage Explorer",
datetime(2021-05-27T06:05:13.1334979Z), "FlushFile", "0MB", "200", "test_file.csv", "Microsoft Azure Storage Explorer",
datetime(2021-05-27T06:05:14.1334979Z), "LeaseFile", "0MB", "200", "test_file.csv", "Microsoft Azure Storage Explorer",
datetime(2021-05-27T06:05:15.1334979Z), "GetBlob", "256MB", "206", "test_file.csv", "azsdk-python-storage-blob/12.8.1 Python/3.8.10",
datetime(2021-05-27T06:05:16.1334979Z), "GetBlob", "128MB", "206", "test_file.csv", "azsdk-python-storage-blob/12.8.1 Python/3.8.10",
datetime(2021-05-27T06:05:17.1334979Z), "GetBlob", "128MB", "206", "test_file.csv", "azsdk-python-storage-blob/12.8.1 Python/3.8.10",
datetime(2021-05-27T06:05:18.1334979Z), "GetBlob", "128MB", "206", "test_file.csv", "azsdk-python-storage-blob/12.8.1 Python/3.8.10",
datetime(2021-05-27T06:05:19.1334979Z), "GetBlob", "128MB", "206", "test_file.csv", "azsdk-python-storage-blob/12.8.1 Python/3.8.10",
datetime(2021-05-27T06:05:20.1334979Z), "GetBlob", "128MB", "206", "test_file.csv", "azsdk-python-storage-blob/12.8.1 Python/3.8.10"
]
| summarize StartTime=min(TimeGenerated), EndTime=max(TimeGenerated), Filename=any(Filename), UserAgent=any(UserAgent), MethodCount=count() by OperationName
| project-reorder StartTime, EndTime, OperationName, Filename, UserAgent, MethodCount
输出：
| StartTime | EndTime | OperationName | Filename | UserAgent | MethodCount |
|---|---|---|---|---|---|
| 2021-05-27 06:03:59.5708689 | 2021-05-27 06:03:59.5708689 | CreateFilePath | test_file.csv | Microsoft Azure Storage Explorer | 1 |
| 2021-05-27 06:04:03.3834404 | 2021-05-27 06:05:14.1334979 | LeaseFile | test_file.csv | Microsoft Azure Storage Explorer | 2 |
| 2021-05-27 06:05:06.1334979 | 2021-05-27 06:05:12.1334979 | AppendFile | test_file.csv | Microsoft Azure Storage Explorer | 7 |
| 2021-05-27 06:05:13.1334979 | 2021-05-27 06:05:13.1334979 | FlushFile | test_file.csv | Microsoft Azure Storage Explorer | 1 |
| 2021-05-27 06:05:15.1334979 | 2021-05-27 06:05:20.1334979 | GetBlob | test_file.csv | azsdk-python-storage-blob/12.8.1 Python/3.8.10 | 6 |