Kusto语言。仅当前一个时间值不相同时才获取一个值

Question

对我非常模糊的标题的背景：我有4个虚拟机将他们的日志发送到应用程序见解。我检索日志并使用kusto语言将其转换为表格。

结果表

Query: 
AzureActivity
| where ResourceProvider == "Microsoft.Compute" and ActivityStatus == "Succeeded" and OperationName == "Deallocate Virtual Machine"
| project DeallocateResource=Resource ,DeallocatedDate=format_datetime(EventSubmissionTimestamp, 'yyyy-MM-dd') ,DeallocatedTime=format_datetime(EventSubmissionTimestamp, 'HH:mm:ss')
| join kind=fullouter
(
AzureActivity
| where ResourceProvider == "Microsoft.Compute" and ActivityStatus == "Succeeded" and OperationName == "Start Virtual Machine"
| project StartupResource=Resource ,StartDate=format_datetime(EventSubmissionTimestamp, 'yyyy-MM-dd') ,StartTime=format_datetime(EventSubmissionTimestamp, 'HH:mm:ss')
)
on $right.StartupResource == $left.DeallocateResource
| where StartDate == DeallocatedDate
| project Resource=coalesce(StartupResource, DeallocateResource) ,
Date=format_datetime(todatetime(coalesce(StartDate, DeallocatedDate)), 'dd/MM/yyyy' ) 
 , StartTime= StartTime ,StopTime=DeallocatedTime , 
Runtime_Hours = format_datetime(datetime_add('minute',datetime_diff('minute', todatetime(strcat(StartDate , " " , DeallocatedTime )) , todatetime(strcat(StartDate , " " , StartTime ))), make_datetime(2017,1,1)), 'hh:mm') 
| sort by Date asc , Resource asc

正如您所看到的，当VM在8:15启动并且在8:58停止并且运行时间为12:43小时时，运行时不正确，那么就会出现问题。在VM的活动日志中，我看到一些同事对VM做了一些奇怪的事情。并开始了几次（他再次启动它一分钟后，当你同时点击两次开始按钮时可能是一个小故障）。

活动日志

我确实找到了解决我问题的理论解决方案：我的查询需要更改，以便运行时甚至启动和停止时间只需在VM启动后跟随停止时才会记录在时间表中。但是atm我得到了所有的“启动虚拟机”和所有“停止虚拟机”，只需在表格中对它们进行排序，这会导致我的结果表中出现混乱。

但我似乎无法找到在我的查询中调整此方法的方法。要说启动虚拟机仅在当天的第一天（当前一个不是启动虚拟机时）或之前的日志是“解除分配虚拟机”，因为这不是通过订单启动 - 停止。一天的时间需要在公式中。仅当前一个是启动虚拟机时才获取解除分配虚拟机。并计算每次运行的运行时间而不是每天。

因为我对SQL和kusto都很陌生，而且我不是在这里找人向我提供解决方案或为我工作。我希望是否有人可以帮助我或指导我找到解决问题的正确方向。

提前致谢 ！！！

Answer 1

请检查以下方法是否让您更接近您的需求。

datatable(Resource:string, Event:string, EventTime:datetime)
[
    'Machine1', 'Start', datetime(2019-04-12 00:00),
    'Machine1', 'Stop', datetime(2019-04-12 01:00),
    'Machine1', 'Start', datetime(2019-04-12 01:30),
    'Machine1', 'Start', datetime(2019-04-12 01:45),
    'Machine1', 'Stop', datetime(2019-04-12 11:45),
    // Machine2
    'Machine2', 'Start', datetime(2019-04-12 00:00),
    'Machine2', 'Stop', datetime(2019-04-12 01:00),
    'Machine2', 'Stop', datetime(2019-04-12 01:20),
    'Machine2', 'Start', datetime(2019-04-12 01:30),
    'Machine2', 'Stop', datetime(2019-04-12 11:45),
]
| order by Resource asc, EventTime asc
| extend IsSameResource = (prev(Resource) == Resource)
| extend PrevState = iif(IsSameResource, prev(Event), Event), CurrentState = Event
| extend RunTime = iif(PrevState == 'Start' and CurrentState == 'Stop', EventTime - prev(EventTime), time(null)), 
         StartTime = prev(EventTime)
| where isnotnull(RunTime)
| project Resource, StartTime, EndTime = EventTime, RunTime

[编辑]

相同的方法 - 但使用问题中提供的列：

let AzureActivity = datatable(ResourceProvider:string, Resource:string, ActivityStatus:string, OperationName:string, EventSubmissionTimestamp:datetime)
[
"Microsoft.Compute", 'Machine1', "Succeeded", 'Start Virtual Machine', datetime(2019-04-12 00:00),
"Microsoft.Compute", 'Machine1',  "Succeeded", 'Deallocate Virtual Machine', datetime(2019-04-12 01:00),
"Microsoft.Compute", 'Machine1',  "Succeeded", 'Start Virtual Machine', datetime(2019-04-12 01:30),
"Microsoft.Compute", 'Machine1',  "Succeeded", 'Start Virtual Machine', datetime(2019-04-12 01:45),
"Microsoft.Compute", 'Machine1',  "Succeeded", 'Deallocate Virtual Machine', datetime(2019-04-12 11:45),
    // Machine2
"Microsoft.Compute", 'Machine2',  "Succeeded", 'Start Virtual Machine', datetime(2019-04-12 00:00),
"Microsoft.Compute", 'Machine2',  "Succeeded", 'Deallocate Virtual Machine', datetime(2019-04-12 01:00),
"Microsoft.Compute", 'Machine2',  "Succeeded", 'Deallocate Virtual Machine', datetime(2019-04-12 01:20),
"Microsoft.Compute", 'Machine2',  "Succeeded", 'Start Virtual Machine', datetime(2019-04-12 01:30),
"Microsoft.Compute", 'Machine2',  "Succeeded", 'Deallocate Virtual Machine', datetime(2019-04-12 11:45),
];
AzureActivity
| where ResourceProvider == "Microsoft.Compute"
| where OperationName in ('Deallocate Virtual Machine','Start Virtual Machine')
| where ActivityStatus == 'Succeeded'
| order by Resource asc, EventSubmissionTimestamp asc
| extend IsSameResource = (prev(Resource) == Resource)
| extend PrevState = iif(IsSameResource, prev(OperationName), OperationName), CurrentState = OperationName
| extend RunTime = iif(PrevState == 'Start Virtual Machine' and CurrentState == 'Deallocate Virtual Machine', EventSubmissionTimestamp - prev(EventSubmissionTimestamp), time(null)), 
         StartTime = prev(EventSubmissionTimestamp)
| where isnotnull(RunTime)
| project Resource, StartTime, EndTime = EventSubmissionTimestamp, RunTime