Kusto - 根据存储桶值呈现柱形图（扩展运算符）

Question

如果我运行对以下数据表进行以下查询，对于事件 _count>10，我得到的结果仅为 10E。是否有任何其他类别未显示在存储桶中的原因。我想根据事件计数类别呈现柱形图。谢谢

    | summarize event_count=count() by State
    | where event_count > 10
    | extend bucket = case (
    event_count > 10, "10E",
    event_count > 100, "100E",
    event_count > 500, "500E",
    event_count > 1000, "1000E",
    event_count > 5000, ">5000E",
    "N/A")
| project bucket```


datatable (State: string, event_count: long) [
    "VIRGIN ISLANDS",long(12),
    "AMERICAN SAMOA",long(16),
    "DISTRICT OF COLUMBIA",long(22),
    "LAKE ERIE",long(27),
    "LAKE ST CLAIR",long(32),
    "LAKE SUPERIOR",long(34),
    "RHODE ISLAND",long(51),
    "LAKE HURON",long(63),
    "CONNECTICUT",long(148)
]

Answer 1

当“case”函数中的条件为真时，它不会继续执行下一个。由于您的所有计数都大于 10，因此第一个类别对所有计数都是正确的。您似乎希望条件小于或等于，这里是一个示例：

datatable (State: string, event_count: long) [
    "VIRGIN ISLANDS",long(12),
    "AMERICAN SAMOA",long(16),
    "DISTRICT OF COLUMBIA",long(22),
    "LAKE ERIE",long(27),
    "LAKE ST CLAIR",long(32),
    "LAKE SUPERIOR",long(34),
    "RHODE ISLAND",long(51),
    "LAKE HURON",long(63),
    "CONNECTICUT",long(148)
]
    | where event_count > 10
    | extend bucket = case (
    event_count <= 10, "10E",
    event_count <= 100, "100E",
    event_count <= 500, "500E",
    event_count <= 1000, "1000E",
    event_count <= 5000, ">5000E",
    "N/A")
| summarize sum(event_count) by bucket
| render columnchart

bucket	sum_event_count
100E	257
500E	148

Kusto - 根据存储桶值呈现柱形图（扩展运算符）

Kusto - Render Column chart as per bucket values (extend operator)

kql

azure-data-explorer

kusto-explorer