列内的日期时间差（Kusto 查询语言）答案

【问题标题】：Date time difference within a column (Kusto Query Language)列内的日期时间差（Kusto 查询语言）
【发布时间】：2021-07-19 18:13:46
【问题描述】：

我有一个这样的单服务器数据集。因此，多个服务器在一个 kusto 表中都有多个这样的记录，例如 Table1.

TimeStamp   State   Servername  Type
7/13/2021   Healthy abcdefgh    Server
7/13/2021   Repair  abcdefgh    Server
7/14/2021   Repair  abcdefgh    Server
7/15/2021   Repair  abcdefgh    Server
7/15/2021   Healthy abcdefgh    Server
7/15/2021   Healthy abcdefgh    Server
7/16/2021   Repair  abcdefgh    Server
7/17/2021   Repair  abcdefgh    Server
7/17/2021   Repair  abcdefgh    Server
7/17/2021   Repair  abcdefgh    Server
7/18/2021   Repair  abcdefgh    Server
7/18/2021   Repair  abcdefgh    Server
7/19/2021   Repair  abcdefgh    Server
7/19/2021   Repair  abcdefgh    Server

我需要知道一次停留在修复状态超过 10 天的服务器列表。（查询不应该添加之前的修复状态时间，因为上面的服务器正在修复并恢复健康）。只需要连续的修复时间。有人可以帮忙吗？我进行了以下查询，但这并没有按预期工作。

Table1
| order by TIMESTAMP desc
| extend prevstate = prev(State)
| where prevstate == State
| summarize arg_max(TIMESTAMP,*) by Servername  //summarizing the top time//
| extend endtime = TIMESTAMP //assigning the top time//
| join kind= innerunique (Table1) //joining same table to find the startdate//
on Servername
| order by TIMESTAMP desc
| extend prevstate = prev(State)
| where prevstate == State
| summarize arg_min(TIMESTAMP,*) by Servername   //summarizing the start time//
| extend starttime= TIMESTAMP
| extend Duration = datetime_diff('day',endtime,starttime)
| project Server, State, Duration

【问题讨论】：

标签： azure-data-explorer kql

【解决方案1】：

首先将记录分组到具有相同 Servername 和 State 的不间断分区中，然后检查最旧和最年轻的观察是否相隔 10 天以上：

datatable(TimeStamp:datetime, Servername:string, State:string)
[
  '2021-07-01', 'abc', 'Healthy',
  '2021-07-02', 'abc', 'Repair',
  '2021-07-04', 'def', 'Healthy',
  '2021-07-05', 'abc', 'Healthy',
  '2021-07-07', 'abc', 'Repair',
  '2021-07-10', 'def', 'Healthy',
  '2021-07-18', 'abc', 'Repair',
]
| order by Servername, TimeStamp
| extend new_partition = Servername != prev(Servername) or State != prev(State)
| extend partition_id = row_cumsum(toint(new_partition))
| where State == 'Repair'
| summarize 
    repair_start = min(TimeStamp),
    repair_last = max(TimeStamp)
    by Servername, partition_id
| project Servername, repair_start, repair_last, duration = repair_last - repair_start
| where duration > 10d

【讨论】：