Azure Log Analytics聚合查詢

Question

我在使用以下查詢創建時遇到問題。

我試圖在一小時的時間間隔內獲得四台計算機的平均會話數。 然后我想繪制24小時內四個平均值的總和。

到目前為止，我有一個使用連接的查詢，但我無法得到正確的結果。

 // Total Sessions for all four computers
    Perf
    | project Computer, bin(TimeGenerated,1h) 
    | where Computer == "s-az-vdigpu2.company.local" or Computer == "s-az-vdigpu4.company.local" or Computer == "s-az-vdigpu5.company.local" or Computer == "s-az-vdigpu6.company.local"
    | join kind= inner (
        Perf
        | where Computer == "s-az-vdigpu2.company.local" or Computer == "s-az-vdigpu4.company.local" or Computer == "s-az-vdigpu5.company.local" or Computer == "s-az-vdigpu6.company.local"
        | where CounterName  == "Total Sessions"
        | summarize avg(CounterValue) by Computer, bin(TimeGenerated, 1h)
 ) on TimeGenerated
| summarize sum(avg_CounterValue) by TimeGenerated
| render timechart 

Answer 1

下面的代碼似乎正在起作用。 我使用了聯合而不是聯接。

    // Total Sessions for all four computers
Perf
| project Computer, bin(TimeGenerated,1h) 
| where Computer == "s-az-vdigpu2.company.local" or Computer == "s-az-vdigpu4.company.local" or Computer == "s-az-vdigpu5.company.local" or Computer == "s-az-vdigpu6.company.local"
| union (
    Perf
    | where Computer == "s-az-vdigpu2.company.local" or Computer == "s-az-vdigpu4.company.local" or Computer == "s-az-vdigpu5.company.local" or Computer == "s-az-vdigpu6.company.local"
    | where CounterName  == "Total Sessions"
    | summarize avg(CounterValue) by Computer, bin(TimeGenerated, 1h)
    | project-rename avg_CounterValue, interval=TimeGenerated
) 
| summarize sum(avg_CounterValue) by interval
| render timechart