Kusto：如何汇总计算数据

Question

我有从表 1 中读取的开始和结束计算列。并比较这段时间内发生了多少事件。

Input Data:
    let Mytable1=datatable (Vin:string,start_time:datetime ,End_time:datetime )
    [ABC,datetime(2021-03-18 08:49:08.467), datetime(2021-03-18 13:32:28.000),
    ABC,datetime(2021-03-18 13:41:59.323),datetime(2021-03-18 13:41:59.323),
    ABC,datetime(2021-03-18 13:46:59.239),datetime(2021-03-18 14:58:02.000)];

    let Mytable2=datatable(Vin:string,Timestamp:datetime)
    [ABC,datetime(2021-03-18 08:49:08.467),ABC,datetime(2021-03-18 08:59:08.466),ABC,datetime(2021-03-18 09:04:08.460),ABC,datetime(2021-03-18 13:24:27.0000000)];

查询：

let Test=Table1 
|where Vin =="ABC" | distinct Vin,Start_Time,End_Time;
let min1=toscalar(Test |summarize min1= min(Start_Time));
let max1=toscalar(Test |summarize max1=max(End_Time));
Table2
|where Vin =="ABC" and  Timestamp between (todatetime(min1) ..todatetime(max1))
| join  kind=fullouter   Test
on  $left.Vin == $right.Vin and $left.Timestamp== $right.Start_Time 
|summarize Events= (count())  by Timestamp,Vin,Start_Time,End_Time
|project Timestamp,Start_Time,End_Time,Events

上述查询的输出是：但我的预期输出是：表示事件从两个开始和结束时间开始计数。

Answer 1

您不应在最终聚合中包含时间戳。一个工作示例可能如下所示：

let measurement_range=datatable (vin:string,start_time:datetime ,end_time:datetime )
["ABC",datetime(2021-03-18 08:49:08.467),datetime(2021-03-18 13:32:28.000),
 "ABC",datetime(2021-03-18 13:41:59.323),datetime(2021-03-18 13:44:59.323),
 "ABC",datetime(2021-03-18 13:46:59.239),datetime(2021-03-18 14:58:02.000),
 ];
let measurement=datatable(vin:string,timestamp:datetime)
    ["ABC",datetime(2021-03-18 08:49:08.467),
     "ABC",datetime(2021-03-18 08:59:08.466),
     "ABC",datetime(2021-03-18 09:04:08.460),
     "ABC",datetime(2021-03-18 13:42:27.0000000)];
measurement_range
| join kind=inner (measurement) 
        on vin     
| where timestamp between (start_time..end_time)
| summarize event=(count()) by vin, start_time, end_time

有了这个，您就可以得到测量值 window。在此示例中，您将获得一个较大的中间结果集，因为在 where 语句中考虑了时间范围。请参阅 Azure Data Explorer Documentation 如何优化时间 window 连接（该示例对于较大的数据集效率不高）。

Kusto：如何汇总计算数据

Kusto: How summarize calculated data

kql