無法獲取查詢以實現特定結果

Question

我正在使用 azure 日志並希望獲得更好的數據用於我的監控。 因為我從來沒有真正使用過 sql、kql 和其他我對它很陌生。 基本的東西沒問題，但目前我需要/想要做一些我不知道如何實現或什至可能的事情。 我將在下面發布示例數據。

我有包含以下列的日志：時間戳、消息、operation_Name 和 operation_Id。 使用 operation_Id，我可以將日志划分和分組在一起。 比起使用消息和時間戳，我想得到（在最好的情況下）這樣的東西：

日志示例：

時間戳	信息	操作名稱	操作_Id
2023-01-31T14:32:31.709377Z	執行 Function X...	函數X	e029727cdece47f83e26dfdbf7a913e9
2023-01-31T14:32:31.7091679Z	隨機日志消息...	函數X	e029727cdece47f83e26dfdbf7a913e9
2023-01-31T14:32:31.3316605Z	請求 Part_Two of Function X...	函數X	e029727cdece47f83e26dfdbf7a913e9
2023-01-31T14:32:30.8697249Z	請求 Part_One of Function X...	函數X	e029727cdece47f83e26dfdbf7a913e9
2023-01-31T14:32:29.3168458Z	正在執行 Function X...	函數X	e029727cdece47f83e26dfdbf7a913e9

結果示例：

操作名稱	全程	特別時間
函數X	0:0:1.3168458Z	0:0:0.7168458Z
函數Y	0:0:2.3168458Z	0:0:0.5268458Z

其中whole_time是所有 FunctionsX 從第一個日志到最后一個日志的平均時間， special_time是所有 FunctionsX 從帶有特定消息的日志（ Request Part_One of Function X ）到帶有特定消息（ Request Part_Two of Function X ）的平均時間。

有 2 個查詢（一個用於 whole_time，一個用於 special_time）的選項仍然很棒。

我嘗試准備示例數據（因為它來自 azure 日志，所以有更多列，但我相信它們與我需要的無關，但如果沒有，我可以編輯它們）。

datatable(timestamp:datetime, message:string, operation_Name:string, operation_Id:string)
[
    "2023-01-31T14:32:31.709377Z"  ,"Executed Function X..."             ,"functionX" ,"e029727cdece47f83e26dfdbf7a913e9"
   ,"2023-01-31T14:32:31.7091679Z" ,"Random log message..."              ,"functionX" ,"e029727cdece47f83e26dfdbf7a913e9"
   ,"2023-01-31T14:32:31.3316605Z" ,"Request Part_Two of Function X ..." ,"functionX" ,"e029727cdece47f83e26dfdbf7a913e9"
   ,"2023-01-31T14:32:30.8697249Z" ,"Request Part_One of Function X ..." ,"functionX" ,"e029727cdece47f83e26dfdbf7a913e9"
   ,"2023-01-31T14:32:29.3168458Z" ,"Executing Function X..."            ,"functionX" ,"e029727cdece47f83e26dfdbf7a913e9"
   ,"2023-01-31T12:32:32.709377Z"  ,"Executed Function Y..."             ,"functionY" ,"3228ac8dd386d2354cba71b1276fb3a5"
   ,"2023-01-31T12:32:31.7091679Z" ,"Random log message..."              ,"functionY" ,"3228ac8dd386d2354cba71b1276fb3a5"
   ,"2023-01-31T12:32:31.3316605Z" ,"Request Part_Two of Function Y ..." ,"functionY" ,"3228ac8dd386d2354cba71b1276fb3a5"
   ,"2023-01-31T12:32:30.5697249Z" ,"Request Part_One of Function Y ..." ,"functionY" ,"3228ac8dd386d2354cba71b1276fb3a5"
   ,"2023-01-31T12:32:29.2168458Z" ,"Executing Function Y..."            ,"functionY" ,"3228ac8dd386d2354cba71b1276fb3a5"
   ,"2023-01-31T11:42:31.709377Z"  ,"Executed Function X..."             ,"functionX" ,"209f9245e29831539cfa5c96f8c39e0c"
   ,"2023-01-31T11:42:31.7091679Z" ,"Random log message..."              ,"functionX" ,"209f9245e29831539cfa5c96f8c39e0c"
   ,"2023-01-31T11:42:31.3316605Z" ,"Request Part_Two of Function X ..." ,"functionX" ,"209f9245e29831539cfa5c96f8c39e0c"
   ,"2023-01-31T11:42:30.8697249Z" ,"Request Part_One of Function X ..." ,"functionX" ,"209f9245e29831539cfa5c96f8c39e0c"
   ,"2023-01-31T11:42:29.6168458Z" ,"Executing Function X..."            ,"functionX" ,"209f9245e29831539cfa5c96f8c39e0c"
]

小提琴

我將不勝感激任何幫助，因為我不知道如何實現這樣的目標，或者是否有可能實現。

Answer 1

datatable(timestamp:datetime, message:string, operation_Name:string, operation_Id:string)
[
    "2023-01-31T14:32:31.709377Z"  ,"Executed Function X..."             ,"functionX" ,"e029727cdece47f83e26dfdbf7a913e9"
   ,"2023-01-31T14:32:31.7091679Z" ,"Random log message..."              ,"functionX" ,"e029727cdece47f83e26dfdbf7a913e9"
   ,"2023-01-31T14:32:31.3316605Z" ,"Request Part_Two of Function X ..." ,"functionX" ,"e029727cdece47f83e26dfdbf7a913e9"
   ,"2023-01-31T14:32:30.8697249Z" ,"Request Part_One of Function X ..." ,"functionX" ,"e029727cdece47f83e26dfdbf7a913e9"
   ,"2023-01-31T14:32:29.3168458Z" ,"Executing Function X..."            ,"functionX" ,"e029727cdece47f83e26dfdbf7a913e9"
   ,"2023-01-31T12:32:32.709377Z"  ,"Executed Function Y..."             ,"functionY" ,"3228ac8dd386d2354cba71b1276fb3a5"
   ,"2023-01-31T12:32:31.7091679Z" ,"Random log message..."              ,"functionY" ,"3228ac8dd386d2354cba71b1276fb3a5"
   ,"2023-01-31T12:32:31.3316605Z" ,"Request Part_Two of Function Y ..." ,"functionY" ,"3228ac8dd386d2354cba71b1276fb3a5"
   ,"2023-01-31T12:32:30.5697249Z" ,"Request Part_One of Function Y ..." ,"functionY" ,"3228ac8dd386d2354cba71b1276fb3a5"
   ,"2023-01-31T12:32:29.2168458Z" ,"Executing Function Y..."            ,"functionY" ,"3228ac8dd386d2354cba71b1276fb3a5"
   ,"2023-01-31T11:42:31.709377Z"  ,"Executed Function X..."             ,"functionX" ,"209f9245e29831539cfa5c96f8c39e0c"
   ,"2023-01-31T11:42:31.7091679Z" ,"Random log message..."              ,"functionX" ,"209f9245e29831539cfa5c96f8c39e0c"
   ,"2023-01-31T11:42:31.3316605Z" ,"Request Part_Two of Function X ..." ,"functionX" ,"209f9245e29831539cfa5c96f8c39e0c"
   ,"2023-01-31T11:42:30.8697249Z" ,"Request Part_One of Function X ..." ,"functionX" ,"209f9245e29831539cfa5c96f8c39e0c"
   ,"2023-01-31T11:42:29.6168458Z" ,"Executing Function X..."            ,"functionX" ,"209f9245e29831539cfa5c96f8c39e0c"
]
| summarize whole_time   = max(timestamp) - min(timestamp) 
           ,special_time = take_anyif(timestamp, message startswith_cs "Request Part_Two") - take_anyif(timestamp, message startswith_cs "Request Part_One")
            by operation_Id, operation_Name
| summarize whole_time = avg(whole_time), special_time = avg(special_time) by operation_Name

操作名稱	全程	特別時間
函數X	00:00:02.2425312	00:00:00.4619356
函數Y	00:00:03.4925312	00:00:00.7619356

小提琴