KQL - 细分项目每天处于特定状态的时间跨度

Question

我正在尝试使用 KQL 计算某个项目在特定状态下处于活动状态的时间。目前我正在将窗口函数与分区一起使用。当我需要计算一段时间内的总“状态时间”时，这很有效，但是当尝试每天（或任何任意粒度）分解它时，就会出现问题。

输入：

let inputData=datatable(id:string, status: string, timestamp: datetime) [ 
    "id1","P",datetime(2024-03-12T05:30:15),
    "id1","F",datetime(2024-03-14T10:10:00),
    "id2","P",datetime(2024-03-12T05:30:15)
];
let startDate=datetime(2024-03-12T00:00:00);
let endDate=datetime(2024-03-15T00:00:00);

应用以下查询可得出每个 id 在每个状态下花费的总时间：

inputData
| partition hint.strategy=native by id
    (
        order by timestamp asc
        | extend tsDiff = min_of(endDate, next(timestamp)) - timestamp
        | extend pTime = iif(status == "P", tsDiff, timespan(0))
        | extend fTime = iif(status == "F", tsDiff, timespan(0))
    )
    | summarize totalPTime=sum(pTime), totalFTime=sum(fTime) by id

Results:
id  totalPTime  totalFTime
id1 2.04:39:45  13:50:00
id2 2.18:29:45  00:00:00

现在我对如何在日常工作中分解这个问题感到困惑。尝试使用例如 make-series 给出：

inputData
| partition hint.strategy=native by id
    (
        order by timestamp asc
        | extend tsDiff = min_of(endDate, next(timestamp)) - timestamp
        | extend pTime = iif(status == "P", tsDiff, timespan(0))
        | extend fTime = iif(status == "F", tsDiff, timespan(0))
    )
    | make-series 
        totalP=sum(pTime),
        totalF=sum(fTime) on timestamp from startDate to endDate step 1d by id

Results:
id  totalP  totalF  timestamp
id1 ["2.04:39:45","00:00:00","00:00:00"]    ["00:00:00","00:00:00","13:50:00"]  ["2024-03-12","2024-03-13","2024-03-14"]
id2 ["2.18:29:45","00:00:00","00:00:00"]    ["00:00:00","00:00:00","00:00:00"]  ["2024-03-12","2024-03-13","2024-03-14"]

我需要的结果是最多 1 天，如果有意义的话，可以溢出到第二天。例如：

id  totalP  totalF  timestamp
id1 ["1.00:00:00","1.00:00:00","04:39:45"]  ["00:00:00","00:00:00","13:50:00"]  ["2024-03-12","2024-03-13","2024-03-14"]
id2 ["1.00:00:00","1.00:00:00","18:29:45"]  ["00:00:00","00:00:00","00:00:00"]  ["2024-03-12","2024-03-13","2024-03-14"]

我是否走在正确的轨道上，或者我应该利用一些其他功能来实现此目的？非常感谢任何帮助！

Answer 1

您可以使用 mv-apply 运算符添加每天的条目：

inputData
| partition hint.strategy=native by id
    (
        order by timestamp asc
        | extend dur = next(timestamp, 1, endDate) - timestamp
        | mv-apply td = range(0d, dur, 1d) to typeof(timespan) on (
            extend tsDiff = iff(dur - td >= 1d, 1d, dur - td)
            | extend timestamp = timestamp + td
        )
        | extend pTime = iif(status == "P", tsDiff, timespan(0))
        | extend fTime = iif(status == "F", tsDiff, timespan(0))
    )
    | make-series 
        totalP=sum(pTime),
        totalF=sum(fTime) on timestamp from startDate to endDate step 1d by id