Kusto 查询 (KQL) 迭代子查询中的标量值

如何解决Kusto 查询 (KQL) 迭代子查询中的标量值

以下是假设的架构。

Table : With billions of entries
Column: info 
Column: id_1
Column: data_1
Column: Uid
Column: time_interval

我想查询什么？

我需要从 Uid 获取符合某些条件的 Table 列表，例如

• time_interval 只需 5 分钟
• info 包含“信息”
• id_ 等于“Guid1”
• data_1 有这种模式“Something”

此外，Table 中的每个 uid 可以跨越多个请求，例如

  Uid    time_interval   ...other_colums....
=====================
  uid1   00:00:12  
  uid1   00:00:13
  uid1   00:00:15

一旦我得到 Uid 列表并将其存储为标量 假设它是 [uid1,uid2,uid3]。 然后，我需要再次查询 Table 并比较标量列表中的每个值以找到 每个 uid 的最大和最小时间之间的差异 以上面的 uid1 示例为例：时差为：(00:00:15 - 00:00:12) 毫秒。

So my result for [uid1,uid3] should be:

Uid      time_diff
====     =========
uid1      2 ms
uid2      3 ms
uid3      4 ms

我在下面有以下查询，但使用标量的子查询仅从标量定义的“数据”中获取最后一个值。请建议我如何使子查询迭代“数据”中的结果

到目前为止我尝试了什么？

此外，我无法将这些合并为一个，因为数据是这样的，在放置 where 子句后，我只会得到一条记录，并且没有时间间隔来计算差异。这就是为什么我需要先获取所有 id，然后查询时间间隔。

let data = toscalar(Table
| where time_interval between (ago(5m)..Now())
| where info has "info"
| where id_1 == "Guid1"
| where data_1 matches regex "Something"
| project pack("uid",Uid));

Table
| where time_interval between (ago(5m)..Now())
| where Uid in (data["uid"])
//| summarize dt1 = max(time_interval) - min(time_interval) by Uid
| project Uid,Rid,time_interval

解决方法

请检查以下是否是您要查找的内容。请注意，in() operator 限制为 100 万个值，因此如果过滤器后有更多不同的 ID，则需要在 2 个数据集之间使用内连接（如果基数非常高，shuffle join 可能会有所帮助）。

let T = datatable(time_interval:datetime,id_1:string,info:string,data_1:string) 
[
    datetime(2021-05-21 10:53:04),"Guid1","no match","this has something in it",datetime(2021-05-21 10:53:06),"this has info in it",datetime(2021-05-21 10:53:09),datetime(2021-05-21 10:53:04),"Guid2",datetime(2021-05-21 10:53:08),"this has something in it"
];
let ids = T
| where time_interval between (datetime(2021-05-21 10:50)..5m)
| where info has "info"
| where id_1 == "Guid1"
| where data_1 matches regex "something"
| distinct id_1;
T 
| where id_1 in (ids)
| summarize min(time_interval),max(time_interval) by id_1

,

似乎简单地将其合并为一个查询就可以了：

let Table = datatable(time_interval:datetime,data_1:string) 
    [datetime(2021-05-21 10:53:04),"this has something in it"];
Table
| where time_interval between (ago(10d) .. now())
| where info has "info"
| where data_1 has "Something"
| summarize time_diff = max(time_interval) - min(time_interval) by id_1
| project id_1,time_diff

例如：