azure-data-explorer

问题 I have a list of Employee names and Salaries in the following order I need to create the output table in the below format. ie, whenever the accumulated salary-total crosses 3000 I have to detect that and mark that row. I have tried to do row_cumsum and reset the Term once it crossed 3000 but it didn't work for the second iteration. datatable (name:string, month:int, salary:long) [ "Alice", 1, 1000, "Alice", 2, 2000, "Alice", 3, 1400, "Alice", 3, 1400, "Alice", 3, 1400, ] | order by name asc,

问题 I have below query which returns %CPU of each Computer by every 1 hour Query Perf | where TimeGenerated > ago(1h) | where CounterName == "% Processor Time" | where Computer endswith "XYZ" | summarize avg(CounterValue) by bin(TimeGenerated, 1h), Computer Result I want to append Dummy row for each-row in the table with fixed value except TimeGenerated should be same as previous row in the table. Expecting result should look something like this. Expected Result 回答1: you could try something like

问题 I have following query in kusto language: AzureActivity | where ResourceProvider == "Microsoft.Compute" | where OperationName in ('Deallocate Virtual Machine','Start Virtual Machine') | where ActivityStatus == 'Succeeded' | order by Resource asc, EventSubmissionTimestamp asc | extend IsSameResource = (prev(Resource) == Resource) | extend PrevState = iif(IsSameResource, prev(OperationName), OperationName), CurrentState = OperationName | extend RunTime = iif(PrevState == 'Start Virtual Machine'

问题 I'm trying to produce a Kusto query to measure the "own" duration of the requests (subtracting out durations of dependencies). However, I can't really figure out how to work this out through a pure Kusto query. To better understand what would would expected, below a sample case: High level view (where R is the request and Dx the dependencies) R =============================== (31ms) D1 ******* (7ms) D2 ******** (8ms) D3 ****** (6ms) D4 ** (2ms) D5 **** (4ms) Proj ==*************======******==

问题 I'm trying to test a connection between my node and Azure Data Explorer (ADX/ Kusto). I'm thinking to create a table on Kusto using a python script. Please be aware that I'm not very familiar with any of this, hence the detailed steps below. I'm following this quickstart guide on Microsoft docs. Generate application ID and key Using App Registrations service: Create new registration (named kusto test): Create a client secrets: Create Kusto DB From the cluster, create a database from the UI

问题 I've got some JSON data coming into an IOT Hub, which then triggers a function to un-nest the data. The function sends this data to an Event Hub, and then the data is supposed to be ingested by Azure Data Explorer according to the mapping I've set up. The problem is that no data makes it to the data explorer; the only way it will receive data with a mapping is by setting the origin as an event hub that is receiving information by custom routing. Is it possible to ingest data in the data

问题 I've got some JSON data coming into an IOT Hub, which then triggers a function to un-nest the data. The function sends this data to an Event Hub, and then the data is supposed to be ingested by Azure Data Explorer according to the mapping I've set up. The problem is that no data makes it to the data explorer; the only way it will receive data with a mapping is by setting the origin as an event hub that is receiving information by custom routing. Is it possible to ingest data in the data

问题 I'm implementing retry for failed ingest operation on ADX, my question is in the title. On the side note, I saw some differences between IngestionStatus (getting ingest status via table) and IngestionFailureInfo (getting ingest status via queue) IngestionStatus have Status.PartiallySucceeded , while IngestionFailureInfo have no way to tell whether an ingest operation is partially succeeded or not. Can Status.PartiallySucceeded occur when ingesting from stream ? How can I know if an ingest

问题 I have a JSON schema that I get from the server and I need to transform this JSON into a log analytics query language table and use that table to make a join with another table. The JSON has the following schema: [{ "X": "xyz", "Y": "xyz", "Z": "xyz", "prop1": "value1", "prop2": "value2", "prop3": "value3" }, { "X": "xyz", "Y": "xyz", "Z": "xyz", "prop1": "value1", "prop2": "value2", "prop3": "value3" }] I tried this : let table = todynamic('[{ "X": "xyz", "Y": "xyz", "Z": "xyz", "prop1":

问题 I start with a list of failures that take place in locations failureName, failureLocation failure a, location 1 failure b, location 1 failure a, location 2 failure a, location 1 <etc> I can transform that into this table by using summarize count() by location failureName, failureLocation, count failure a, location 1, 100 failure a, location 2, 50 failure b, location 1, 10 <etc> I'd like to transform the counts into percent on a per. failure basis, so I need to add a sum per failure name. My