kusto查询以显示其他两列之后的第三列

问题描述 投票:0回答:1

您好,我想在下面的Kusto查询中显示摄取时间,请提供建议吗?>

find withsource=source in (cluster(X).database('y*').['TextFileLogs'])
where AttemptedIngestTime > ago(7d)
and FileLineContent contains "<li>Build Number:" 
| distinct source , FileLineContent //, AttemptedIngestTime
| extend databaseName = extract(@"""(oci-[^""]*)""", 1, source)
| extend BuildNumber = extract(@"([A-Z]\w*\.[0-9]\d*\.[0-9]\d*\.[0-9]\d*)",1,FileLineContent)
| extend StampVersion = extract(@"([0-9]\d*\.[0-9]\d*\.[0-9]\d*\.[0-9]\d*)",1,FileLineContent)
| extend cluster = X
//| extend IngestedTime = AttemptedIngestTime
|  summarize NumberOfRuns=count() by BuildNumber , StampVersion

[我正在尝试在下面的Kusto查询中显示摄取时间,您能否在(cluster(X).database('y *')。['TextFileLogs'])中的AttemptedIngestTime> ..中提供带有source = source的建议查找。 。

kusto azure-data-explorer kql
1个回答
0
投票

您可以将distinct source, FileLineContent替换为summarize min(AttemptedIngestTime) by source, FileLineContent

© www.soinside.com 2019 - 2024. All rights reserved.