如何在一个 Kusto 查询中进行 2 个汇总操作？答案

【问题标题】：How to do 2 summarize operation in one Kusto query?如何在一个 Kusto 查询中进行 2 个汇总操作？
【发布时间】：2021-02-24 02:08:11
【问题描述】：

我被 Kusto 查询卡住了。这就是我想要做的 - 我想在同一天显示上个月销售额的每日销售额。

datatable(DateStamp:datetime, OrderId:string, SalesAmount:int) 
[
   "02-01-2019", "I01", 100,
   "02-01-2019", "I02", 200,
   "02-02-2019", "I03", 250,
   "02-02-2019", "I04", 150,
   "02-03-2019", "I13", 110,
   "01-01-2019", "I10", 20,
   "01-02-2019", "I11", 50,
   "01-02-2019", "I12", 30,
]
| extend SalesDate = format_datetime(DateStamp, 'MM/dd/yyyy')
| summarize AmountOfSales = sum(SalesAmount) by SalesDate

这是我看到的。

而且，这就是我想要显示的结果--

我不知道如何在一个查询中添加多个汇总运算符。

【问题讨论】：

标签： azure-data-explorer kql

【解决方案1】：

这是一个选项：

datatable(DateStamp:datetime, OrderId:string, SalesAmount:int) 
[
   "02-01-2019", "I01", 100,
   "02-01-2019", "I02", 200,
   "02-02-2019", "I03", 250,
   "02-02-2019", "I04", 150,
   "02-03-2019", "I13", 110,
   "01-01-2019", "I10", 20,
   "01-02-2019", "I11", 50,
   "01-02-2019", "I12", 30,
]
| summarize AmountOfSales = sum(SalesAmount) by bin(DateStamp, 1d)
| as hint.materialized = true T
| extend prev_month = datetime_add("Month", -1, DateStamp)
| join kind=leftouter T on $left.prev_month == $right.DateStamp
| project SalesDate = format_datetime(DateStamp, 'MM/dd/yyyy'), AmountOfSales, AmountOfSalesPrevMonth = coalesce(AmountOfSales1, 0)

SalesDate	AmountOfSales	AmountOfSalesPrevMonth
01/01/2019	20	0
01/02/2019	80	0
02/01/2019	300	20
02/02/2019	400	80
02/03/2019	110	0

【讨论】：