Kusto 查询以从 table 获取排队的事件

Question

任何人都可以帮助根据以下 table 数据构建 kusto 查询：

ProcessName	ProcessID	TimeStamp	Status
abc	101	11:45:06	Queued
xyz	102	11:45:51	Queued
abc	101	11:45:57	Progress
abc	101	11:47:28	Succeeded
abc	103	11:48:51	Queued
abc	103	11:49:57	Progress
abc	103	11:50:28	Succeeded

我想获取查询结果中处于排队状态的xyz值，条件是大于5m处于排队状态。

这是我一直在尝试但没有成功的方法。

let Events = MyLogTable | where ... ;

Events
| where Status == "Queued"
| project ProcessName, ProcessId, StartTime=TimeStamp
| join (Events 
        | where Status !in ("InProgress","Succeeded")
        | project ProcessId) 
    on ProcessId
| where StartTime>ago(5m)
| project ProcessName, ProcessId, StartTime, Status

非常感谢任何帮助，提前致谢。

Answer 1

假设每个进程 ID 恰好有一条记录 Status == Queued，这可能有效：

let Events = datatable(ProcessName:string, ProcessID:int, TimeStamp:datetime, Status:string)
[
    'abc', 101, datetime(2021-02-02 11:45:06), 'Queued',
    'xyz', 102, datetime(2021-02-02 11:45:51), 'Queued',
    'abc', 101, datetime(2021-02-02 11:45:57), 'Progress',
    'abc', 101, datetime(2021-02-02 11:47:28), 'Succeeded',
    'abc', 103, datetime(2021-02-02 11:48:51), 'Queued',
    'abc', 103, datetime(2021-02-02 11:49:57), 'Progress',
    'abc', 103, datetime(2021-02-02 11:50:28), 'Succeeded',
]
;
Events
| where Status == "Queued" and ago(5m) > TimeStamp
| where ProcessID !in ((
    Events
    | where Status != "Queued"
    | project ProcessID
))

Kusto 查询以从 table 获取排队的事件

Kusto query to get queued events from a table

kql

azure-data-explorer