在汇总操作的结果列中查找最大值和最小值

Question

我正在尝试找出一种方法来计算列的最大值和最小值。

使用下面的查询，我首先使用汇总操作计算（每分钟请求数）RPM，然后想为 RPM 列选择最大值和最小值。

从技术上讲，我可以在对列（asc 或 desc）排序后使用 take 操作来获取最小值或最大值，但它的计算效率似乎不高。此外，它只提供最大值或最小值，而不是同时提供这两个值。

最终输出应该如下所示 table:

RPM                   Timestamp
----                       
Max: value (e.g) 13 | 2022-03-02T14 
Min: value (e.g) 2  | 2022-03-06T11

let T = datatable(Timestamp:datetime, ResultType:string, ResultSignature:string, CorrelationId:string) [
"2022-03-02T14:35:05.6846874Z", "Throttled", "200", "a8de8a0b-2b95-4e16-a90f-d96c1f404850",
"2022-03-02T14:35:06.9535229Z", "Throttled", "200", "7e00ac15-6e82-42a5-8171-3145ae27728f",
"2022-03-02T14:34:21.1880149Z", "Non-Throttled", "200", "8fa9f7ee-6a91-4b8c-b170-9649befa698c",
"2022-03-02T14:34:36.9887590Z", "Non-Throttled", "200", "de7d82be-49b8-44dc-856c-16f76c7a4ae5",
"2022-03-02T14:34:39.3999879Z", "Non-Throttled", "200", "99b67d55-3ee4-4aee-9415-03919b2f23a4",
"2022-03-02T14:34:40.7854748Z", "Non-Throttled", "400", "dec5cd49-9d64-469a-83aa-db759c2e2fb1",
"2022-03-02T14:34:44.2007485Z", "Non-Throttled", "200", "5b412e71-6e48-49e2-9298-fd13d31619d1",
"2022-03-02T14:34:55.6858503Z", "Throttled", "200", "482592f9-722c-4f5d-8e48-967fa655d704",
"2022-03-02T14:25:17.0269766Z", "Throttled", "200", "1732c865-2474-4f76-b0cd-64af5981af7c",
"2022-03-02T14:25:18.9668944Z", "Throttled", "200", "234ec84c-3a0a-4329-a492-f8d590267ec6",
"2022-03-02T14:25:21.8262878Z", "Throttled", "200", "be8bd024-8f5c-4a01-9703-2945ef3bc8ba",
    ];
T 
| project Timestamp, ResultType, ResultSignature , CorrelationId
| summarize   RPM = count() by bin(Timestamp,1m)
| order by RPM desc
| take 1

Answer 1

您可以在 already-aggregated 计数之上使用 arg_min() 和 arg_max() 聚合函数。

例如：

let T = datatable(Timestamp:datetime, ResultType:string, ResultSignature:string, CorrelationId:string) [
"2022-03-02T14:35:05.6846874Z", "Throttled", "200", "a8de8a0b-2b95-4e16-a90f-d96c1f404850",
"2022-03-02T14:35:06.9535229Z", "Throttled", "200", "7e00ac15-6e82-42a5-8171-3145ae27728f",
"2022-03-02T14:34:21.1880149Z", "Non-Throttled", "200", "8fa9f7ee-6a91-4b8c-b170-9649befa698c",
"2022-03-02T14:34:36.9887590Z", "Non-Throttled", "200", "de7d82be-49b8-44dc-856c-16f76c7a4ae5",
"2022-03-02T14:34:39.3999879Z", "Non-Throttled", "200", "99b67d55-3ee4-4aee-9415-03919b2f23a4",
"2022-03-02T14:34:40.7854748Z", "Non-Throttled", "400", "dec5cd49-9d64-469a-83aa-db759c2e2fb1",
"2022-03-02T14:34:44.2007485Z", "Non-Throttled", "200", "5b412e71-6e48-49e2-9298-fd13d31619d1",
"2022-03-02T14:34:55.6858503Z", "Throttled", "200", "482592f9-722c-4f5d-8e48-967fa655d704",
"2022-03-02T14:25:17.0269766Z", "Throttled", "200", "1732c865-2474-4f76-b0cd-64af5981af7c",
"2022-03-02T14:25:18.9668944Z", "Throttled", "200", "234ec84c-3a0a-4329-a492-f8d590267ec6",
"2022-03-02T14:25:21.8262878Z", "Throttled", "200", "be8bd024-8f5c-4a01-9703-2945ef3bc8ba",
]
;
let M = materialize(
    T
    | summarize RPM = count() by bin(Timestamp, 1m)
    | summarize (minRpm, minT) = arg_min(RPM, Timestamp),
                (maxRpm, maxT) = arg_max(RPM, Timestamp)
);
union 
(M | project RPM = minRpm, Timestamp = minT, Label = "Min"),
(M | project RPM = maxRpm, Timestamp = maxT, Label = "Max")

在汇总操作的结果列中查找最大值和最小值

Find max and min values in a column which is a result of summary operation

azure-monitoring

kql

azure-data-explorer

azure-monitor-workbooks

azure-monitor