除了将范围传递给用户定义的函数之外，还有其他选择吗？

如何解决除了将范围传递给用户定义的函数之外，还有其他选择吗？

由于无法使用随行上下文而变化的参数调用用户定义的函数，因此我正在努力寻找替代方法。

我有一个表，其中包含记录会话结束后会话开始和结束时间的行。我希望能够可视化一段时间内的连接数。

我提供了一个示例数据表 (T) 作为示例。

由于用户定义的函数限制，以下不起作用。

let T = datatable (TimeGenerated:datetime,ConnectionId:string,Start:datetime,End:datetime)
[ datetime('2021-02-11T20:21:58.680Z'),"0001",datetime('2021-02-11T20:20:50.172Z'),datetime('2021-02-11T20:21:28.673Z'),datetime('2021-02-11T20:21:58.517Z'),"0002",datetime('2021-02-11T20:04:40.131Z'),datetime('2021-02-11T20:20:52.742Z'),datetime('2021-02-11T20:21:57.470Z'),"0003",datetime('2021-02-11T20:17:51.585Z'),datetime('2021-02-11T20:18:41.945Z'),datetime('2021-02-11T20:21:56.793Z'),"0004",datetime('2021-02-11T20:18:04.508Z'),datetime('2021-02-11T20:19:16.594Z'),datetime('2021-02-11T20:21:55.697Z'),"0005",datetime('2021-02-11T20:15:20.139Z'),datetime('2021-02-11T20:18:26.688Z')
];
let bins = 1m;
let ConnectionsAtTime = (timestamp:datetime) {
toscalar(
T
| where Start <= timestamp and End >= timestamp
| count
)
};
let fakeNow = datetime('2021-02-11T20:22:00Z');
range timestamp from fakeNow - 5m to fakeNow step bins
| extend Count = ConnectionsAtTime(timestamp)

但是，如果它确实有效，我希望得到以下输出：

时间戳	计数
2/11/2021，晚上 8:12:00.000	1
2/11/2021，晚上 8:13:00.000	1
2/11/2021，晚上 8:14:00.000	1
2/11/2021，晚上 8:15:00.000	1
2/11/2021，晚上 8:16:00.000	2
2/11/2021，晚上 8:17:00.000	2
2/11/2021，晚上 8:18:00.000	3
2/11/2021，晚上 8:19:00.000	2
2/11/2021，晚上 8:20:00.000	1
2/11/2021，晚上 8:21:00.000	1
2/11/2021，晚上 8:22:00.000	0

解决方法

您可以尝试以下方法：

let T = datatable (TimeGenerated:datetime,ConnectionId:string,Start:datetime,End:datetime)
[ 
  datetime('2021-02-11T20:21:58.680Z'),"0001",datetime('2021-02-11T20:20:50.172Z'),datetime('2021-02-11T20:21:28.673Z'),datetime('2021-02-11T20:21:58.517Z'),"0002",datetime('2021-02-11T20:04:40.131Z'),datetime('2021-02-11T20:20:52.742Z'),datetime('2021-02-11T20:21:57.470Z'),"0003",datetime('2021-02-11T20:17:51.585Z'),datetime('2021-02-11T20:18:41.945Z'),datetime('2021-02-11T20:21:56.793Z'),"0004",datetime('2021-02-11T20:18:04.508Z'),datetime('2021-02-11T20:19:16.594Z'),datetime('2021-02-11T20:21:55.697Z'),"0005",datetime('2021-02-11T20:15:20.139Z'),datetime('2021-02-11T20:18:26.688Z')
];
let bins = 1m;
let fakeNow = datetime('2021-02-11T20:22:00Z');
let ConnectionsAtTime = (T:(Start:datetime,End:datetime,ConnectionId:string),range_start:datetime,range_end:datetime,bin:timespan)
{
    T
    | mv-expand timestamp = range(range_start,range_end,bin) to typeof(datetime)
    | summarize dcountif(ConnectionId,Start <= timestamp and End >= timestamp) by timestamp
}
;
T
| invoke ConnectionsAtTime(fakeNow - 5m,fakeNow,bins)

-->

时间戳	countif_
2021-02-11 20:17:00.0000000	2
2021-02-11 20:18:00.0000000	3
2021-02-11 20:19:00.0000000	2
2021-02-11 20:20:00.0000000	1
2021-02-11 20:21:00.0000000	1
2021-02-11 20:22:00.0000000	0