检查值是否在定义时间的阈值限制之间 window - KQL 查询

Question

我想在 Kusto 中编写一个查询，检查汽车的速度是否始终在特定速度限制（例如 b/w 100 和 150 km/h）之间 window 5分钟。任何线索都将受到高度赞赏。

可以使用以下数据集作为示例：

Timestamp	Speed	Temperature
2022-01-01 00:01:00.0000000	142.5	25.5
2022-01-01 00:02:00.0000000	133.2	25.4
2022-01-01 00:03:00.0000000	124.8	25.6
2022-01-01 00:04:00.0000000	115.3	25.5
2022-01-01 00:05:00.0000000	98.4	25.4
2022-01-01 00:06:00.0000000	106.3	26.3
2022-01-01 00:07:00.0000000	119.6	26.5
2022-01-01 00:08:00.0000000	134.7	25.4
2022-01-01 00:09:00.0000000	128.2	26.6
2022-01-01 00:10:00.0000000	137.5	25.5
2022-01-01 00:11:00.0000000	139.9	27.4
2022-01-01 00:12:00.0000000	140.1	26.3
2022-01-01 00:13:00.0000000	145.4	25.7
2022-01-01 00:14:00.0000000	158.7	24.4
2022-01-01 00:15:00.0000000	155.8	25.6

期望的结果如下：

Timestamp	Speed	Temperature
2022-01-01 00:06:00.0000000	106.3	26.3
2022-01-01 00:07:00.0000000	119.6	26.5
2022-01-01 00:08:00.0000000	134.7	25.4
2022-01-01 00:09:00.0000000	128.2	26.6
2022-01-01 00:10:00.0000000	137.5	25.5

过滤掉数据的前 5 分钟和后 5 分钟，因为在这 5 分钟内 windows 发现速度超出了 100 - 150 km/h 的范围。

Answer 1

let t = datatable (Timestamp:datetime ,Speed:real ,Temperature:real)
[
     '2022-01-01 00:01:00.0000000' ,142.5 ,25.5
    ,'2022-01-01 00:02:00.0000000' ,133.2 ,25.4
    ,'2022-01-01 00:03:00.0000000' ,124.8 ,25.6
    ,'2022-01-01 00:04:00.0000000' ,115.3 ,25.5
    ,'2022-01-01 00:05:00.0000000' ,98.4  ,25.4
    ,'2022-01-01 00:06:00.0000000' ,106.3 ,26.3
    ,'2022-01-01 00:07:00.0000000' ,119.6 ,26.5
    ,'2022-01-01 00:08:00.0000000' ,134.7 ,25.4
    ,'2022-01-01 00:09:00.0000000' ,128.2 ,26.6
    ,'2022-01-01 00:10:00.0000000' ,137.5 ,25.5
    ,'2022-01-01 00:11:00.0000000' ,139.9 ,27.4
    ,'2022-01-01 00:12:00.0000000' ,140.1 ,26.3
    ,'2022-01-01 00:13:00.0000000' ,145.4 ,25.7
    ,'2022-01-01 00:14:00.0000000' ,158.7 ,24.4
    ,'2022-01-01 00:15:00.0000000' ,155.8 ,25.6
];
let min_Timestamp = toscalar(t | summarize min(Timestamp));
t
| summarize make_list(Timestamp), make_list(Speed), make_list(Temperature) by bin_at(Timestamp, 5m, min_Timestamp)
| extend list_Speed_stat = series_stats_dynamic(list_Speed)  
| where list_Speed_stat["min"] >= 100 and list_Speed_stat["max"] <= 150
| mv-expand Timestamp = list_Timestamp, Speed = list_Speed, Temperature  = list_Temperature  
| project todatetime(Timestamp), toreal(Speed), toreal(Temperature)

Timestamp	Speed	Temperature
2022-01-01T00:06:00Z	106.3	26.3
2022-01-01T00:07:00Z	119.6	26.5
2022-01-01T00:08:00Z	134.7	25.4
2022-01-01T00:09:00Z	128.2	26.6
2022-01-01T00:10:00Z	137.5	25.5

Fiddle

检查值是否在定义时间的阈值限制之间 window - KQL 查询

Check if value is between threshold limits for a defined time window - KQL query

sliding-window

kql

azure-data-explorer

kusto-explorer