在 Kusto KQL 查询中按自定义时间窗口聚合答案

【问题标题】：Aggregate by custom time windows in Kusto KQL Query在 Kusto KQL 查询中按自定义时间窗口聚合
【发布时间】：2023-01-20 14:34:25
【问题描述】：

我正在尝试在另一个表（在执行测试时捕获）提供的特定时间窗口中聚合指标值。

let TestTimes = datatable (start:datetime, end:datetime, testId:string)
[
 datetime(2022-09-15T09:29-4), datetime(2022-09-15T13:10-4), "test1",
 datetime(2022-09-15T17:51-4), datetime(2022-09-15T22:12-4), "test2",
 datetime(2022-09-20T10:50-4), datetime(2022-09-20T15:10-4), "test3",
 datetime(2022-09-21T09:00-4), datetime(2022-09-21T14:20-4), "test4",
 datetime(2022-09-21T16:00-4), datetime(2022-09-21T20:00-4), "test5",
 . . .
];

我创建了一个接受度量表和开始/结束时间的简单函数

let CountMetric = (T:(Timestamp:datetime, Name:string),startTime:datetime, endTime:datetime, metricName:string) {
  T 
  | where Timestamp between(startTime..endTime)        
  | where Name == metricName
  | summarize count = count()
};

我可以单独调用该函数：

CountMetric(MyMetricsTable, datetime(2022-09-15T09:29-4), datetime(2022-09-15T13:10-4), "Metric1");

但是，我不能在查询上下文中调用它，例如在测试时间表行上运行它：

TestTimes
| extend Metric1Counts = CountMetric(MyMetricsTable, start, end, "Metric1")

我得到的错误是：当前上下文中不应出现表格表达式

知道如何解决这个简单的问题吗？

【问题讨论】：

请更改此帖子主题。当前的与您的实际问题无关。
温馨提示接受答案

标签： azure-data-explorer kql

【解决方案1】：

这需要一些杂技......

let MyMetricsTable = // data sample generation. Not part of the solution.
    materialize
    (
        range i from 1 to 10000 step 1
        | extend Timestamp = datetime(2022-09-10) + 15d*rand()
                ,Name = strcat("Metric", tostring(toint(rand(3) + 1)))
    );
let TestTimes = datatable (start:datetime, end:datetime, testId:string)
    [
        datetime(2022-09-15T09:29:00-04), datetime(2022-09-15T13:10:00-04), "test1"
       ,datetime(2022-09-15T17:51:00-04), datetime(2022-09-15T22:12:00-04), "test2"
       ,datetime(2022-09-20T10:50:00-04), datetime(2022-09-20T15:10:00-04), "test3"
       ,datetime(2022-09-21T09:00:00-04), datetime(2022-09-21T14:20:00-04), "test4"
       ,datetime(2022-09-21T16:00:00-04), datetime(2022-09-21T20:00:00-04), "test5"
    ];
let CountMetric = (T:(Timestamp:datetime, Name:string),startTime:datetime, endTime:datetime, metricName:string)
    {
    T 
    | where Timestamp between(startTime..endTime)        
    | where Name == metricName
    | summarize count = count()
    }; 
let CountMetricWrapper = (T:(start:datetime, end:datetime, testId:string), metricsTableName:string, metricName:string)
{
    let p_start  = toscalar(T | project start);
    let p_end    = toscalar(T | project end);
    let p_testId = toscalar(T | project testId);
    CountMetric(table(metricsTableName), p_start, p_end, metricName)
    | extend testId = p_testId
};
let TestTimesSerialized =
materialize
(
    TestTimes
    | serialize
    | extend params_batch_id  = row_number(0) / 64 + 1
            ,params_set_id    = row_number(0) % 64 + 1
);  
union  // Each line supports additional 64 parameters sets
    (TestTimesSerialized | where params_batch_id == 1 | partition hint.strategy=legacy by params_set_id (invoke CountMetricWrapper("MyMetricsTable", "Metric1")))
   ,(TestTimesSerialized | where params_batch_id == 2 | partition hint.strategy=legacy by params_set_id (invoke CountMetricWrapper("MyMetricsTable", "Metric1")))
   ,(TestTimesSerialized | where params_batch_id == 3 | partition hint.strategy=legacy by params_set_id (invoke CountMetricWrapper("MyMetricsTable", "Metric1")))

count	testId
32	test1
33	test5
51	test4
44	test2
45	test3

Fiddle

【讨论】：