Join across two different event

ぐ巨炮叔叔 提交于 2021-01-29 07:31:41

问题


I'am writing KQL on Server Query,I want join two event datas.My KQL like this:

let table1=source
|where LogName == "FraudServiceRequest"
| project d_name=LogName,PreciseTimeStamp,ConnectionID,End=substring(TimeStamp,13,20);

let table2=source
| where LogName == "ProxyReceivedRequest"
| project ConnectionID,Start=substring(TimeStamp,13,20);

table1
| join (table2)
    on $left.ConnectionID == $right.ConnectionID
|project ConnectionID,m_Ans=(toreal(End)-toreal(Start))/1000.0

But there no one record response. enter image description here

When i use this code on Client Query,It worked. enter image description here

I want get it on Server Query,because i want use the code on LogsToMetrics of the Geneva.

来源:https://stackoverflow.com/questions/63483951/join-across-two-different-event

易学教程内所有资源均来自网络或用户发布的内容,如有违反法律规定的内容欢迎反馈
该文章没有解决你所遇到的问题?点击提问,说说你的问题,让更多的人一起探讨吧!