Azure

Azure Log Analytics – Kusto Question – Get Min/Max Inside Every Class Filter

In continuation of my earlier submit on Get Categorial Rely, this time let’s get our palms soiled with yet one more question associated to filter standards for date time discipline.

 

Beneath is the pattern information on which we’re going to question,

 

GenerationDate

IngestionTime

DescriptionTitle

DescriptionDetail

FeedKey

2020-05-21 00:00:00:0000000

2020-05-25 02:00:00:0000000

Schedule Activity

Learn feed from server 1

acbf-uhef-4t5i-dfff

2020-05-21 00:00:00:0000000

2020-05-25 03:00:00:3000000

Schedule Activity

Learn feed from server 1

acbf-uhef-4t5i-dfff

2020-05-21 00:00:00:0000000

2020-05-25 03:00:00:3500000

Schedule Activity

Learn feed from server 1

acbf-uhef-4t5i-dfff

2020-05-21 00:00:00:0000000

2020-05-25 03:00:00:3000000

Monitoring Activity

Monitoring failed for LOC

lcbf-u78f-4p5i-dfff

2020-05-21 00:00:00:0000000

2020-05-26 02:00:00:0000000

Schedule Activity

Information lacking for palto

acbf-uhef-4t5i-dfff

2020-05-22 00:00:00:0000000

2020-05-26 00:09:00:0000000

Schedule Activity

Learn feed from server 1

acbf-uhef-4t5i-dfff

2020-05-22 00:00:00:0000000

2020-05-27 00:04:00:0000000

Failover Dealing with

Disk fault occurred in area R

acbf-uhef-4t5i-dfff

 

Question description

 

For every distinctive mixture of FeedKey and Description, discover the utmost and minimal Ingestion time.

 

  1. let reality = DemoData  
  2. the place GenerationDate == datetime(2020-05-21)  
  3. | summarize dcount(FeedKey) by DescriptionTitle, DescriptionDetail, FeedKey, GenerationDate; 
  4.  
  5. let minIngestionTimes = reality | be part of type=leftouter DemoData on FeedKey, DescriptionTitle, DescriptionDetail, GenerationDate  
  6. | undertaking FeedKey, DescriptionTitle, DescriptionDetail, GenerationDate, IngestionTime   
  7. | summarize MinIngestTime = arg_min(IngestionTime,*) by FeedKey, DescriptionTitle, DescriptionDetail;  

  8. let maxIngestionTimes = reality | be part of type=leftouter DemoData on FeedKey, DescriptionTitle, DescriptionDetail, GenerationDate  
  9. | undertaking FeedKey, DescriptionTitle, DescriptionDetail, GenerationDate, IngestionTime  
  10. | summarize MaxIngestTime = arg_max(IngestionTime,*) by FeedKey, DescriptionTitle, DescriptionDetail;  

  11. minIngestionTimes | be part of type=innerunique maxIngestionTimes on FeedKey, DescriptionTitle, DescriptionDetail  
  12. | lengthen Description = strcat(DescriptionTitle,” : “, DescriptionDetail)  
  13. | undertaking FeedKey, Description, MinIngestTime, MaxIngestTime, GenerationDate,  
  14. | type by FeedKey  

Anticipated Output

 

FeedKey

Description

MinIngestTime

MaxIngestTime

GenerationDate

acbf-uhef-4t5i-dfff

Schedule Activity : Learn feed from server 1

2020-05-25 02:00:00:0000000

2020-05-25 03:00:00:3500000

2020-05-21 00:00:00:0000000

lcbf-u78f-4p5i-dfff

Monitoring Activity : Monitoring failed for LOC

2020-05-25 03:00:00:3000000

2020-05-25 03:00:00:3000000

2020-05-21 00:00:00:0000000

acbf-uhef-4t5i-dfff

Schedule Activity : Information lacking for palto

2020-05-26 02:00:00:0000000

2020-05-26 02:00:00:0000000

2020-05-21 00:00:00:0000000

 

Joyful querying! 

Show More

Related Articles

Leave a Reply

Your email address will not be published. Required fields are marked *

Back to top button