列 Kusto 查询的优先级排序

Question

场景：玩家可以被标记为赢家、平手或输家。状态的优先级是这样的：如果一个玩家曾经“平局”，他们就不能成为“输家”，如果他们曾经是“赢家”，他们就不能成为“输家”或“平局” . Table 1 记录了错误行，但所需的 table 应显示玩家及其最新状态以及最新正确记录的时间戳。这对 Kusto 来说是可行的吗？我可以使用下面的查询按时间戳 select 最近的。我不确定如何比较。我已经开始查看 prev() 函数，但我不确定这是否会根据优先级进行比较来满足我的要求。 (https://docs.microsoft.com/en-us/azure/data-explorer/kusto/query/prevfunction)

          let T1 = datatable(player:string, status:string, timestamp:datetime)
        [
            "A", "winner", datetime(2020-11-24 08:00),
            "A", "winner", datetime(2020-11-24 10:00),
            "B", "tied", datetime(2020-11-24 09:00),
            "B", "tied", datetime(2020-11-24 11:00),
            "B", "tied", datetime(2020-11-24 14:00),
            "B", "loser", datetime(2020-11-24 15:00),
            "C", "loser", datetime(2020-11-24 08:00),
            "C", "loser", datetime(2020-11-24 10:00),
            "C", "loser", datetime(2020-11-24 11:00),
            "C", "loser", datetime(2020-11-24 13:00),
            "C", "tied", datetime(2020-11-24 14:00),
            "C", "winner", datetime(2020-11-24 15:00),
            "D", "winner", datetime(2020-11-24 07:00),
            "D", "winner", datetime(2020-11-24 11:00),
            "D", "winner", datetime(2020-11-24 16:00),
            "D", "tied", datetime(2020-11-24 21:00),
            "E", "tied", datetime(2020-11-24 09:00),
            "E", "tied", datetime(2020-11-24 11:00),
            "E", "loser", datetime(2020-11-24 13:00),
            "E", "tied", datetime(2020-11-24 18:00),
            "F", "loser", datetime(2020-11-24 10:00),
            "F", "loser", datetime(2020-11-24 11:00),
            "F", "loser", datetime(2020-11-24 18:00),
            "G", "loser", datetime(2020-11-24 11:00),
            "G", "tied", datetime(2020-11-24 14:00),
            "G", "loser", datetime(2020-11-24 16:00),
            "G", "tied", datetime(2020-11-24 18:00),
            "G", "loser", datetime(2020-11-24 21:00),
        ]
        ;
        T1
        | summarize arg_max(timestamp, *) by player
        | order by player asc
            
    result:
    player| timestamp                   | status
    _____________________________________________
    A     | 2020-11-24 10:00:00.0000000 | winner
    B     | 2020-11-24 15:00:00.0000000 | loser 
    C     | 2020-11-24 15:00:00.0000000 | winner
    D     | 2020-11-24 21:00:00.0000000 | tied
    E     | 2020-11-24 18:00:00.0000000 | tied
    F     | 2020-11-24 18:00:00.0000000 | loser
    G     | 2020-11-24 21:00:00.0000000 | loser
    H     | 2020-11-24 21:00:00.0000000 | loser

final desired result table:
    player| timestamp                   | status
    _____________________________________________
    A     | 2020-11-24 10:00:00.0000000 | winner
    B     | 2020-11-24 14:00:00.0000000 | tied 
    C     | 2020-11-24 15:00:00.0000000 | winner
    D     | 2020-11-24 16:00:00.0000000 | winner
    E     | 2020-11-24 18:00:00.0000000 | tied
    F     | 2020-11-24 18:00:00.0000000 | loser
    G     | 2020-11-24 18:00:00.0000000 | tied
    H     | 2020-11-24 09:00:00.0000000 | winner

Answer 1

如果我对你的问题的理解正确，下面的方法就可以了。

根据您提供的逻辑（使用 make_set() 和 array_index_of().
计算每个玩家的总状态
找到最大值。每个 player/state 的时间戳，使用 join

let T = 
    datatable(player: string, status: string, timestamp: datetime)
    [
        "A", "winner", datetime(2020-11-24 08:00),
        "A", "winner", datetime(2020-11-24 10:00),
        "B", "tied", datetime(2020-11-24 09:00),
        "B", "tied", datetime(2020-11-24 11:00),
        "B", "tied", datetime(2020-11-24 14:00),
        "B", "loser", datetime(2020-11-24 15:00),
        "C", "loser", datetime(2020-11-24 08:00),
        "C", "loser", datetime(2020-11-24 10:00),
        "C", "loser", datetime(2020-11-24 11:00),
        "C", "loser", datetime(2020-11-24 13:00),
        "C", "tied", datetime(2020-11-24 14:00),
        "C", "winner", datetime(2020-11-24 15:00),
        "D", "winner", datetime(2020-11-24 07:00),
        "D", "winner", datetime(2020-11-24 11:00),
        "D", "winner", datetime(2020-11-24 16:00),
        "D", "tied", datetime(2020-11-24 21:00),
        "E", "tied", datetime(2020-11-24 09:00),
        "E", "tied", datetime(2020-11-24 11:00),
        "E", "loser", datetime(2020-11-24 13:00),
        "E", "tied", datetime(2020-11-24 18:00),
        "F", "loser", datetime(2020-11-24 10:00),
        "F", "loser", datetime(2020-11-24 11:00),
        "F", "loser", datetime(2020-11-24 18:00),
        "G", "loser", datetime(2020-11-24 11:00),
        "G", "tied", datetime(2020-11-24 14:00),
        "G", "loser", datetime(2020-11-24 16:00),
        "G", "tied", datetime(2020-11-24 18:00),
        "G", "loser", datetime(2020-11-24 21:00),
    ]
;
T
| summarize make_set(status) by player
| project player, status = case(array_index_of(set_status, "winner") > -1, "winner",
                                array_index_of(set_status, "tied") > -1, "tied",
                                "loser")
| join (
    T
    | summarize timestamp = max(timestamp) by player, status
) on player, status
| project player, timestamp, status

列 Kusto 查询的优先级排序

Priority Sorting on a column Kusto Query

database

relational-database

kql

azure-data-explorer