Kusto 查询以获取事件随时间变化的百分比值

Question

我在 azure 日志分析中有一个 Kusto / KQL 查询，它汇总了一段时间内的事件计数，例如：

customEvents
| where name == "EventICareAbout"
| extend channel = customDimensions["ChannelName"]
| summarize events=count() by bin(timestamp, 1m), tostring(channel)

这给出了每分钟存储桶中事件计数的良好结果集。

但计数相当没有意义，我想知道该计数是否与过去一小时的平均值不同。

但我什至不知道如何开始构建这样的东西。

任何指针？

Answer 1

有几种方法可以实现这一点，首先，将每小时平均数计算为附加列，然后根据每小时平均数计算差异：

let minuteValues = customEvents
| where name == "EventICareAbout"
| extend channel = customDimensions["ChannelName"]
| summarize events=count() by bin(timestamp, 1m), tostring(channel)
| extend Day = startofday(timestamp), hour =hourofday(timestamp);
let hourlyAverage = customEvents
| where name == "EventICareAbout"
| extend channel = customDimensions["ChannelName"]
| summarize events=count() by bin(timestamp, 1m), tostring(channel)
| summarize hourlyAvgEvents = avg(events) by bin(timestamp,1h), tostring(channel)
| extend Day = startofday(timestamp),hour =hourofday(timestamp);
minuteValues
| lookup hourlyAverage on hour, Day
| extend Diff = events- hourlyAvgEvents

另一种选择是使用内置的Anomaly detection