在具有时间跨度的汇总行上呈现时间表

Question

在 Azure Application Insights 中，我将每个 InvocationId 的 traces 条目分组，以跟踪 Azure Function 的并行调用。

traces
| where timestamp between (todatetime('2022-06-29T21:00:00Z')..todatetime('2022-06-29T22:00:00Z'))
| where tostring(customDimensions.InvocationId) <> "" 
| summarize StartedAt=min(timestamp), FinishedAt=max(timestamp), 
            Succeeded=max(severityLevel)==1
         by operation_Id, tostring(customDimensions.InvocationId)

基于上面的 Kusto 查询，我想创建一个图表，显示一段时间内的并行运行数。当我查看Window functions 和make_series operator 时，我没有找到解决方案。我想呈现一个 timechart，它每分钟显示有多少个并行运行的调用，例如countif(currentMinute? between (StartedAt..FinishedAt))

我怎样才能制作出想要的图表？

Answer 1

更新

简化的解决方案

此解决方案有两个缺点：

1. 图表在没有数据点的情况下可能看起来具有误导性（在 2 点之间延伸的线隐藏了它们之间的事件数实际上为 0 的事实）
2. 如果有很多数据点，图表渲染可能会有内存压力。

   ---

   // Sample generation. Not part of the solution
   let t = materialize(range i from 1 to 100 step 1 | project duration = 1h*rand(), StartedAt = ago(rand()*1d) | extend FinishedAt = StartedAt + duration | project-away duration);
   // Solution starts here 
   t
   |   mv-expand       timestamp   = pack_array(StartedAt, FinishedAt) to typeof(datetime)
                      ,delta       = dynamic([1, -1])                  to typeof(int)
   |   order by        timestamp asc
   |   project         timestamp, running_total = row_cumsum(delta)
   |   render          timechart   
   

   Fiddle

   ---

   当我们已经有了每个调用的 StartedAt 和 FinishedAt 时，此解决方案将从您离开的地方继续。
   从那里我们将每个 StartedAt 计为 +1，将每个 FinishedAt 计为 -1。

   运行总数是每个点的并行执行数。

   // Sample generation. Not part of the solution
   let t = materialize(range i from 1 to 100 step 1 | project duration = 1h*rand(), StartedAt = ago(rand()*1d) | extend FinishedAt = StartedAt + duration | project-away duration);
   // Solution starts here 
   let p_resolution = 15m;
   t
   |   mv-expand       timestamp   = pack_array(StartedAt, FinishedAt) to typeof(datetime)
                      ,delta       = dynamic([1, -1])                  to typeof(int)
   |   order by        timestamp asc
   |   extend          running_total = row_cumsum(delta)
   |   make-series     max(running_total) on timestamp step p_resolution
   |   render          timechart   
   

   Fiddle

Answer 2

基于公认的解决方案，我简化了原始 Kusto 查询，因为 StartedAt 和 FinishedAt 的时间戳可以用 (message startswith "Executing '" or message startswith "Executed '") 标识。考虑到消息，可以提取delta值。它使 summarize 和一个 mv-expand 过时了。

traces
| where timestamp between (todatetime('2022-06-29T21:00:00Z') .. todatetime('2022-06-29T22:00:00Z'))
| where tostring(customDimensions.InvocationId) <> ""
// Adapting the original query from the question..
| where (message startswith "Executing '" or message startswith "Executed '")
| extend delta=case(message startswith "Executing '", 1, -1)
// Using the solution from the accepted answer..
| make-series delta=sum(delta) on timestamp step 5s
| mv-expand timestamp to typeof(datetime), delta to typeof(int)
| serialize 
| project timestamp, running_total = row_cumsum(delta)
| render timechart