如何将来自不同查询的值（计数）合并到一个查询中

Question

在 KQL 中有什么方法可以将来自不同查询的值（计数）合并到一个查询中。

目前我的做法是进行两次查询，获取计数。粘贴第三个查询中的值并找到百分比（请参阅下文）。

// First query
let football_played = database("database1").games_played
| where game_type contains "football"
| where Time > ago(1m);
football_played| count

// Second query
let registered_for_football = database("db2").registerd_players
| where EventInfo_Time > ago(1m)
| where registered_game contains "football"
registered_for_football | count

// Third query
let football_count = 13741;
let registered_count = 701588;
print cnt1 = football_count , cnt2 = registered_count 
| extend percentage = (todouble(cnt1) * 100 / todouble(cnt2))
| project percentage, cnt2, cnt1

在 Kql 中有什么方法可以在单个查询中计算所有内容并打印百分比吗？

提前致谢

Answer 1

你可以试试这个：

let football_played = toscalar(
    database("database1").games_played
    | where Time > ago(1m)
    | where game_type contains "football"
    | count
);
let registered_for_football = toscalar(
    database("db2").registered_players
    | where EventInfo_Time > ago(1m)
    | where registered_game contains "football"
    | count
);
print football_played, registered_for_football 
| extend percentage = round(100.0 * football_played / registered_for_football, 2)

如何将来自不同查询的值（计数）合并到一个查询中

How to combine values (count) from different queries into a single query

kql

azure-data-explorer

azure-monitor