Kusto：状态时间计算

Question

我是 KQL 的新手，现在我正在寻找一种解决方案来计算设备在不同状态下花费的时间。

例如，我有一个来自一台设备的 table，状态为 1-设备活动，0-设备不活动。

datatable (Date: datetime, Status: string) [
    "11/22/2021, 7:22:12.825 PM", "0",
    "11/22/2021, 7:25:13.413 PM", "1",
    "11/22/2021, 7:26:13.282 PM", "1",
    "11/22/2021, 7:31:13.823 PM", "1",
    "11/22/2021, 7:34:13.606 PM", "0",
    "11/22/2021, 7:52:14.206 PM", "1",
    "11/22/2021, 7:55:13.764 PM", "0",
    "11/22/2021, 7:57:14.029 PM", "0",
    "11/26/2021, 11:22:47.466 AM", "1",
    "11/26/2021, 11:25:19.455 PM", "0",
    "11/26/2021, 11:26:19.070 PM", "1",
    "11/27/2021, 4:21:32.515 AM", "1"
]

我想计算设备处于活动状态的时间和处于非活动状态的时间。

我已经尝试过使用 iff 和其他方法的不同方法，但没有得到正确的结果，因为数据具有设备可以一个接一个地发送多个活动状态或非活动状态的流，所以我找不到正确的方法处理重复或删除它们。

感谢任何解决方案

Answer 1

给你：

datatable (Date: datetime, Status: string) [
    "11/22/2021, 7:22:12.825 PM", "0",
    "11/22/2021, 7:25:13.413 PM", "1",
    "11/22/2021, 7:26:13.282 PM", "1",
    "11/22/2021, 7:31:13.823 PM", "1",
    "11/22/2021, 7:34:13.606 PM", "0",
    "11/22/2021, 7:52:14.206 PM", "1",
    "11/22/2021, 7:55:13.764 PM", "0",
    "11/22/2021, 7:57:14.029 PM", "0",
    "11/26/2021, 11:22:47.466 AM", "1",
    "11/26/2021, 11:25:19.455 PM", "0",
    "11/26/2021, 11:26:19.070 PM", "1",
    "11/27/2021, 4:21:32.515 AM", "1"
]
| order by Date asc
| extend Period = next(Date) - Date
| summarize sum(Period) by Status

结果：

Status	sum_Period
0	3.15:49:34.5050000
1	17:09:45.1850000

Kusto：状态时间计算

Kusto: Status time calculation

azure

azure-log-analytics

kql

azure-data-explorer