问题
I'am writing KQL on Server Query,I want join two event datas.My KQL like this:
let table1=source
|where LogName == "FraudServiceRequest"
| project d_name=LogName,PreciseTimeStamp,ConnectionID,End=substring(TimeStamp,13,20);
let table2=source
| where LogName == "ProxyReceivedRequest"
| project ConnectionID,Start=substring(TimeStamp,13,20);
table1
| join (table2)
on $left.ConnectionID == $right.ConnectionID
|project ConnectionID,m_Ans=(toreal(End)-toreal(Start))/1000.0
But there no one record response. enter image description here
When i use this code on Client Query,It worked. enter image description here
I want get it on Server Query,because i want use the code on LogsToMetrics of the Geneva.
来源:https://stackoverflow.com/questions/63483951/join-across-two-different-event