如何记录 kusto 查询以在一个时间表中可视化多个维度？

如何解决如何记录 kusto 查询以在一个时间表中可视化多个维度？

我是 Azure 门户的初学者，尝试写下查询以在图表中列出一些自定义属性。但是，我需要在按每个自定义属性值分组的时间表中查看相同的内容（附上图片）。

let filterByName = 'version';
let events = dynamic(["*"]);
let mainTable = union customEvents
    | extend name =replace("\n","",name)
    | where '*' in (events) or name in (events)
    | where iff(isempty(filterByName),1 == 1,name contains filterByName)
    | where true;
let queryTable = mainTable;
let cohortedTable = queryTable
    | extend dimension = customDimensions["customProperty1"]
    | extend dimension = iif(isempty(dimension),"<undefined>",dimension)
    | summarize hll = hll(itemId) by tostring(dimension)
    | extend Events = dcount_hll(hll)
    | order by Events desc
    | serialize rank = row_number()
    | extend dimension = iff(rank > 5,'Other',dimension)
    | summarize merged = hll_merge(hll) by tostring(dimension)
    | project ['version'] = dimension,Counts = dcount_hll(merged);
cohortedTable

我需要得到一个时间图的输出，如下图所示：

我已经尝试了下面的 kql 日志，但它没有给我预期的输出。

| extend Version=tostring(customDimensions.distVersion)
| summarize count(Version),bin(1d,1h)
| render timechart

请纠正我做错了什么。您对此的回答对我来说将是一个巨大的帮助。谢谢！

解决方法

要生成时间图，您还需要投影 Timegenerated 列以及维度和计数列。以便可以根据每个属性和相应值的 Timegenerated 列生成时间图表。

示例查询：

Perf
| where ObjectName == "K8SContainer"
| where TimeGenerated >= ago(15m)
| summarize count() by CounterName,bin(TimeGenerated,1m)
| render timechart