Kusto 查詢管道查詢

Question

我正在嘗試使用 Azure 數據資源管理器/Kusto 查詢從管道運行數據創建另一列。 我是 Kusto 的新手，不確定如何與 go 聯系。 目標是為每個客戶，

1. 如果上次運行失敗和上次運行失敗，則獲取兩次失敗之間的天數/小時差。
2. 如果上次運行成功而上次運行失敗，則獲取事件之間的天/小時差
3. 如果前一個事件失敗而上一個事件成功，則忽略。

數據集

Customers   PipelineType    PipelineState    TimeStamp
CustomerA   PipelineA   Succes               2021-08-13 12:59:03.0073653
CustomerA   PipelineA   Fail                 2021-08-13 09:59:03.0124853
CustomerA   PipelineB   Succes               2021-08-13 11:56:03.0151948
CustomerA   Pipeline B  Fail                 2021-08-12 17:56:03.0019445
CustomerA   Pipeline C  Succes               2021-08-13 13:16:03.0015617
CustomerA   Pipeline C  Fail                 2021-07-30 21:52:03.0157372
CustomerB   PipelineA   Succes               2021-08-13 12:59:03.0073331
CustomerB   PipelineA   Succes               2021-08-13 12:57:03.0099138
CustomerB   PipelineB   Fail                 2021-07-30 03:33:03.0123262
CustomerB   Pipeline B  Succes               2021-08-13 13:16:03.0015297
CustomerB   Pipeline C  Fail                 2021-08-13 12:57:03.0099499
CustomerB   Pipeline C  Succes               2021-08-13 13:16:03.0016348
CustomerC   PipelineA   Succes               2021-08-13 13:16:03.0016999
CustomerC   PipelineA   Succes               2021-08-13 12:59:03.0074113
CustomerC   PipelineB   Succes               2021-08-13 10:56:03.0075546
CustomerC   Pipeline B  Fail                 2021-08-11 06:54:03.0118628
CustomerC   Pipeline C  Fail                 2021-08-13 13:16:03.0016233
CustomerC   Pipeline C  Fail                 2021-08-13 12:59:03.0072337
``

Answer 1

如果我正確理解了要求，您可以對數據集進行排序，然后使用case()和prev()函數。

例如：

datatable(customer:string, PipelineType:string, PipelineState:string, TimeStamp:datetime)
[
    'CustomerA', 'Pipeline A', 'Fail',    datetime(2021-08-13 12:59:03.0073653),
    'CustomerA', 'Pipeline A', 'Fail',    datetime(2021-08-13 09:59:03.0124853),
    'CustomerA', 'Pipeline B', 'Success', datetime(2021-08-13 11:56:03.0151948),
    'CustomerA', 'Pipeline B', 'Fail',    datetime(2021-08-12 17:56:03.0019445),
    'CustomerA', 'Pipeline C', 'Success', datetime(2021-08-13 13:16:03.0015617),
    'CustomerA', 'Pipeline C', 'Fail',    datetime(2021-07-30 21:52:03.0157372),
    'CustomerB', 'Pipeline A', 'Fail',    datetime(2021-08-13 12:59:03.0073331),
    'CustomerB', 'Pipeline A', 'Success', datetime(2021-08-13 12:57:03.0099138),
    'CustomerB', 'Pipeline B', 'Fail',    datetime(2021-07-30 03:33:03.0123262),
    'CustomerB', 'Pipeline B', 'Success', datetime(2021-08-13 13:16:03.0015297),
    'CustomerB', 'Pipeline C', 'Fail',    datetime(2021-08-13 12:57:03.0099499),
    'CustomerB', 'Pipeline C', 'Success', datetime(2021-08-13 13:16:03.0016348),
    'CustomerC', 'Pipeline A', 'Fail',    datetime(2021-08-13 13:16:03.0016999),
    'CustomerC', 'Pipeline A', 'Fail',    datetime(2021-08-13 12:59:03.0074113),
    'CustomerC', 'Pipeline B', 'Success', datetime(2021-08-13 10:56:03.0075546),
    'CustomerC', 'Pipeline B', 'Fail',    datetime(2021-08-11 06:54:03.0118628),
    'CustomerC', 'Pipeline C', 'Fail',    datetime(2021-08-13 13:16:03.0016233),
    'CustomerC', 'Pipeline C', 'Fail',    datetime(2021-08-13 12:59:03.0072337),
]   
| order by customer asc, PipelineType asc, TimeStamp asc
| extend result = case(prev(customer) == customer and prev(PipelineType) == PipelineType and PipelineState == 'Fail', TimeStamp - prev(TimeStamp), timespan(null))

顧客	管道類型	管道狀態	時間戳	結果
客戶A	流水線A	失敗	2021-08-13 09:59:03.0124853
客戶A	流水線A	失敗	2021-08-13 12:59:03.0073653	02:59:59.9948800
客戶A	管線B	失敗	2021-08-12 17:56:03.0019445
客戶A	管線B	成功	2021-08-13 11:56:03.0151948
客戶A	管道 C	失敗	2021-07-30 21:52:03.0157372
客戶A	管道 C	成功	2021-08-13 13:16:03.0015617
客戶B	流水線A	成功	2021-08-13 12:57:03.0099138
客戶B	流水線A	失敗	2021-08-13 12:59:03.0073331	00:01:59.9974193
客戶B	管線B	失敗	2021-07-30 03:33:03.0123262
客戶B	管線B	成功	2021-08-13 13:16:03.0015297
客戶B	管道 C	失敗	2021-08-13 12:57:03.0099499
客戶B	管道 C	成功	2021-08-13 13:16:03.0016348
客戶C	流水線A	失敗	2021-08-13 12:59:03.0074113
客戶C	流水線A	失敗	2021-08-13 13:16:03.0016999	00:16:59.9942886
客戶C	管線B	失敗	2021-08-11 06:54:03.0118628
客戶C	管線B	成功	2021-08-13 10:56:03.0075546
客戶C	管道 C	失敗	2021-08-13 12:59:03.0072337
客戶C	管道 C	失敗	2021-08-13 13:16:03.0016233	00:16:59.9943896

---

更新：回復您的評論 - 只需添加適當的過濾器。

例如：

datatable(customer:string, PipelineType:string, PipelineState:string, TimeStamp:datetime)
[
    'CustomerA', 'Pipeline A', 'Fail',    datetime(2021-08-13 12:59:03.0073653),
    'CustomerA', 'Pipeline A', 'Fail',    datetime(2021-08-13 09:59:03.0124853),
    'CustomerA', 'Pipeline B', 'Success', datetime(2021-08-13 11:56:03.0151948),
    'CustomerA', 'Pipeline B', 'Fail',    datetime(2021-08-12 17:56:03.0019445),
    'CustomerA', 'Pipeline C', 'Success', datetime(2021-08-13 13:16:03.0015617),
    'CustomerA', 'Pipeline C', 'Fail',    datetime(2021-07-30 21:52:03.0157372),
    'CustomerB', 'Pipeline A', 'Fail',    datetime(2021-08-13 12:59:03.0073331),
    'CustomerB', 'Pipeline A', 'Success', datetime(2021-08-13 12:57:03.0099138),
    'CustomerB', 'Pipeline B', 'Fail',    datetime(2021-07-30 03:33:03.0123262),
    'CustomerB', 'Pipeline B', 'Success', datetime(2021-08-13 13:16:03.0015297),
    'CustomerB', 'Pipeline C', 'Fail',    datetime(2021-08-13 12:57:03.0099499),
    'CustomerB', 'Pipeline C', 'Success', datetime(2021-08-13 13:16:03.0016348),
    'CustomerC', 'Pipeline A', 'Fail',    datetime(2021-08-13 13:16:03.0016999),
    'CustomerC', 'Pipeline A', 'Fail',    datetime(2021-08-13 12:59:03.0074113),
    'CustomerC', 'Pipeline B', 'Success', datetime(2021-08-13 10:56:03.0075546),
    'CustomerC', 'Pipeline B', 'Fail',    datetime(2021-08-11 06:54:03.0118628),
    'CustomerC', 'Pipeline C', 'Fail',    datetime(2021-08-13 13:16:03.0016233),
    'CustomerC', 'Pipeline C', 'Fail',    datetime(2021-08-13 12:59:03.0072337),
]   
| order by customer asc, PipelineType asc, TimeStamp asc
| where not((prev(customer) == customer and prev(PipelineType) == PipelineType and PipelineState == 'Success' and prev(PipelineState) == 'Fail') or 
            (prev(customer) == customer and prev(PipelineType) == PipelineType and PipelineState == 'Fail' and next(PipelineState) == 'Success'))
| extend result = case(prev(customer) == customer and prev(PipelineType) == PipelineType and PipelineState == 'Fail', TimeStamp - prev(TimeStamp), timespan(null))

顧客	管道類型	管道狀態	時間戳	結果
客戶A	流水線A	失敗	2021-08-13 09:59:03.0124853
客戶A	流水線A	失敗	2021-08-13 12:59:03.0073653	02:59:59.9948800
客戶A	管線B	失敗	2021-08-12 17:56:03.0019445
客戶A	管道 C	失敗	2021-07-30 21:52:03.0157372
客戶B	流水線A	成功	2021-08-13 12:57:03.0099138
客戶B	流水線A	失敗	2021-08-13 12:59:03.0073331	00:01:59.9974193
客戶B	管線B	失敗	2021-07-30 03:33:03.0123262
客戶B	管道 C	失敗	2021-08-13 12:57:03.0099499
客戶C	流水線A	失敗	2021-08-13 12:59:03.0074113
客戶C	流水線A	失敗	2021-08-13 13:16:03.0016999	00:16:59.9942886
客戶C	管線B	失敗	2021-08-11 06:54:03.0118628
客戶C	管道 C	失敗	2021-08-13 12:59:03.0072337
客戶C	管道 C	失敗	2021-08-13 13:16:03.0016233	00:16:59.9943896