在日志分析 KQL 中获得不同的结果值

Question

我想从我的查询中获取某些行的不同列，但也想 return 其他列，所以我想结合不同的和项目，但只对我想要唯一值的列使用不同的列。或者更好地说，我希望查询只选择管道运行的一个副本，即使它是运行多次。

ADFActivityRun
| where ActivityType == "Copy" or ActivityType == "ExecuteDataFlow"
| where Status == "Succeeded" or Status == "Failed"
| project TimeGenerated, DataFactory=substring(tostring(split(ResourceId, "/", 8)), 2, strlen(tostring(split(ResourceId, "/", 8)))-4), PipelineRunId, PipelineName, ActivityName, Status, ActivityType, Start, End, ErrorMessage, FailureType, RowsRead  = parse_json(Output).rowsRead, RowsCopied = parse_json(Output).rowsCopied, rowsWritten = parse_json(Output).runStatus.metrics.sink1.rowsWritten |order by TimeGenerated desc 
| distinct PipelineName, PipelineRunId, ActivityName, Status, ActivityType, DataFactory

Answer 1

您可以对任何一个使用 take_any()，或者对最新的使用 arg_max()：

例如：

ADFActivityRun
| where ActivityType in ("Copy", "ExecuteDataFlow")
| where Status in ("Succeeded", "Failed")
| extend Output = parse_json(Output)
| project TimeGenerated, 
          DataFactory = substring(tostring(split(ResourceId, "/", 8)), 2, strlen(tostring(split(ResourceId, "/", 8)))-4),
          PipelineRunId,
          PipelineName,
          ActivityName,
          Status,
          ActivityType,
          Start,
          End,
          ErrorMessage,
          FailureType,
          RowsRead = Output.rowsRead,
          RowsCopied = Output.rowsCopied,
          rowsWritten = Output.runStatus.metrics.sink1.rowsWritten
| summarize arg_max(TimeGenerated, *) by PipelineRunId

在日志分析 KQL 中获得不同的结果值

Getting a distinct value in result in log analytics KQL

azure-pipelines

azure-log-analytics

kql