Azure
Azure Log Analytics – Kusto Question – Get Min/Max Inside Every Class Filter
Beneath is the pattern information on which we’re going to question,
GenerationDate |
IngestionTime |
DescriptionTitle |
DescriptionDetail |
FeedKey |
2020-05-21 00:00:00:0000000 |
2020-05-25 02:00:00:0000000 |
Schedule Activity |
Learn feed from server 1 |
acbf-uhef-4t5i-dfff |
2020-05-21 00:00:00:0000000 |
2020-05-25 03:00:00:3000000 |
Schedule Activity |
Learn feed from server 1 |
acbf-uhef-4t5i-dfff |
2020-05-21 00:00:00:0000000 |
2020-05-25 03:00:00:3500000 |
Schedule Activity |
Learn feed from server 1 |
acbf-uhef-4t5i-dfff |
2020-05-21 00:00:00:0000000 |
2020-05-25 03:00:00:3000000 |
Monitoring Activity |
Monitoring failed for LOC |
lcbf-u78f-4p5i-dfff |
2020-05-21 00:00:00:0000000 |
2020-05-26 02:00:00:0000000 |
Schedule Activity |
Information lacking for palto |
acbf-uhef-4t5i-dfff |
2020-05-22 00:00:00:0000000 |
2020-05-26 00:09:00:0000000 |
Schedule Activity |
Learn feed from server 1 |
acbf-uhef-4t5i-dfff |
2020-05-22 00:00:00:0000000 |
2020-05-27 00:04:00:0000000 |
Failover Dealing with |
Disk fault occurred in area R |
acbf-uhef-4t5i-dfff |
Question description
For every distinctive mixture of FeedKey and Description, discover the utmost and minimal Ingestion time.
- let reality = DemoData
- | the place GenerationDate == datetime(2020-05-21)
- | summarize dcount(FeedKey) by DescriptionTitle, DescriptionDetail, FeedKey, GenerationDate;
- let minIngestionTimes = reality | be part of type=leftouter DemoData on FeedKey, DescriptionTitle, DescriptionDetail, GenerationDate
- | undertaking FeedKey, DescriptionTitle, DescriptionDetail, GenerationDate, IngestionTime
- | summarize MinIngestTime = arg_min(IngestionTime,*) by FeedKey, DescriptionTitle, DescriptionDetail;
- let maxIngestionTimes = reality | be part of type=leftouter DemoData on FeedKey, DescriptionTitle, DescriptionDetail, GenerationDate
- | undertaking FeedKey, DescriptionTitle, DescriptionDetail, GenerationDate, IngestionTime
- | summarize MaxIngestTime = arg_max(IngestionTime,*) by FeedKey, DescriptionTitle, DescriptionDetail;
- minIngestionTimes | be part of type=innerunique maxIngestionTimes on FeedKey, DescriptionTitle, DescriptionDetail
- | lengthen Description = strcat(DescriptionTitle,” : “, DescriptionDetail)
- | undertaking FeedKey, Description, MinIngestTime, MaxIngestTime, GenerationDate,
- | type by FeedKey
Anticipated Output
FeedKey |
Description |
MinIngestTime |
MaxIngestTime |
GenerationDate |
acbf-uhef-4t5i-dfff |
Schedule Activity : Learn feed from server 1 |
2020-05-25 02:00:00:0000000 |
2020-05-25 03:00:00:3500000 |
2020-05-21 00:00:00:0000000 |
lcbf-u78f-4p5i-dfff |
Monitoring Activity : Monitoring failed for LOC |
2020-05-25 03:00:00:3000000 |
2020-05-25 03:00:00:3000000 |
2020-05-21 00:00:00:0000000 |
acbf-uhef-4t5i-dfff |
Schedule Activity : Information lacking for palto |
2020-05-26 02:00:00:0000000 |
2020-05-26 02:00:00:0000000 |
2020-05-21 00:00:00:0000000 |
Joyful querying!