kusto language pivot 2 columns

问题

I have following query in kusto language:

    AzureActivity
| where ResourceProvider == "Microsoft.Compute"
| where OperationName in ('Deallocate Virtual Machine','Start Virtual Machine')
| where ActivityStatus == 'Succeeded'
| order by Resource asc, EventSubmissionTimestamp asc
| extend IsSameResource = (prev(Resource) == Resource)
| extend PrevState = iif(IsSameResource, prev(OperationName), OperationName), CurrentState = OperationName
| extend RunTime = iif(PrevState == 'Start Virtual Machine' and CurrentState == 'Deallocate Virtual Machine', EventSubmissionTimestamp - prev(EventSubmissionTimestamp), time(null)), StartTime = prev(EventSubmissionTimestamp)
| where isnotnull(RunTime)
| project Resource, StartDate= format_datetime(todatetime(StartTime), 'MM/yyyy'),  StopDate=format_datetime(todatetime(EventSubmissionTimestamp), 'MM/yyyy'),
RuntimeThisMonth= iif( format_datetime(todatetime(StartTime), 'MM/yyyy') != format_datetime(todatetime(EventSubmissionTimestamp), 'MM/yyyy') , (datetime_diff('minute',todatetime(EventSubmissionTimestamp) ,startofmonth(EventSubmissionTimestamp)) / 60) ,(datetime_diff('minute',todatetime(EventSubmissionTimestamp) ,todatetime(StartTime)) / 60)) ,
  RuntimeLastMonth=iif( format_datetime(todatetime(StartTime), 'MM/yyyy') != format_datetime(todatetime(EventSubmissionTimestamp), 'MM/yyyy') , (datetime_diff('minute',startofmonth(EventSubmissionTimestamp) ,todatetime(StartTime)) / 60) ,0)

Which gives me following result.

Now I want to pivot the dates that I got this kind of table.

In a previous project I used the evaluate pivot command to pivot the column and sum the Runtimes , but now I have to columns (Lastmonth and this month) and I can't find a way to pivot the two columns.

| evaluate pivot(StartDate, sum(RuntimeLastMonth) , StopDate , sum(RuntimeThisMonth))

Is there someone who knows what I am missing in my pivot query ?

回答1:

This could perhaps work:

datatable(Resource:string, StartDate:datetime, StopDate:datetime, RuntimeThisMonth:long, RuntimeLastMonth:long)
[
    "A", datetime(2019-05-01), datetime(2019-05-01), 33, 0,
    "C", datetime(2019-05-01), datetime(2019-05-01), 0,  0,
    "A", datetime(2019-05-01), datetime(2019-05-01), 9,  0,
    "C", datetime(2019-04-01), datetime(2019-05-01), 69, 48,
    "D", datetime(2019-04-01), datetime(2019-05-01), 69, 48,
]
| where RuntimeLastMonth > 0 or RuntimeThisMonth > 0
| summarize RuntimeLastMonth = sum(RuntimeLastMonth), RuntimeThisMonth = sum(RuntimeThisMonth) by StartDate, StopDate, Resource
| project Resource, p = pack(
    format_datetime(StopDate, "MM/yyyy"), RuntimeThisMonth, 
    format_datetime(StartDate, "MM/yyyy"), RuntimeLastMonth)
| evaluate bag_unpack(p)

➡

| Resource | 05/2019 | 04/2019 |
|----------|---------|---------|
| A        | 42      |         |
| C        | 69      | 48      |
| D        | 69      | 48      |

来源：https://stackoverflow.com/questions/56076972/kusto-language-pivot-2-columns

标签

sql

azure-log-analytics

azure-data-explorer