您好,我想在下面的Kusto查询中显示摄取时间,请提供建议吗?>
find withsource=source in (cluster(X).database('y*').['TextFileLogs'])
where AttemptedIngestTime > ago(7d)
and FileLineContent contains "<li>Build Number:"
| distinct source , FileLineContent //, AttemptedIngestTime
| extend databaseName = extract(@"""(oci-[^""]*)""", 1, source)
| extend BuildNumber = extract(@"([A-Z]\w*\.[0-9]\d*\.[0-9]\d*\.[0-9]\d*)",1,FileLineContent)
| extend StampVersion = extract(@"([0-9]\d*\.[0-9]\d*\.[0-9]\d*\.[0-9]\d*)",1,FileLineContent)
| extend cluster = X
//| extend IngestedTime = AttemptedIngestTime
| summarize NumberOfRuns=count() by BuildNumber , StampVersion
[我正在尝试在下面的Kusto查询中显示摄取时间,您能否在(cluster(X).database('y *')。['TextFileLogs'])中的AttemptedIngestTime> ..中提供带有source = source的建议查找。 。
您可以将distinct source, FileLineContent
替换为summarize min(AttemptedIngestTime) by source, FileLineContent