在 Kusto 中查找从第一行到当前行的最大值（时间序列）

Question

我正在尝试找出如何扩展列以显示从第一行回溯到当前行的最大值（例如，从时间戳最早的行到最新的行循环遍历表）。

这是一个示例输入表：

let T = datatable(Timestamp:datetime, Count:int)
[
   datetime(2021-01-01), 1,
   datetime(2021-01-02), 1,
   datetime(2021-01-03), 2,
   datetime(2021-01-04), 1,
   datetime(2021-01-05), 1,
   datetime(2021-01-06), 3,
   datetime(2021-01-07), 1,
   datetime(2021-01-08), 2,
];

想要的输出是：

Timestamp	Count	MaxToDate
2021-01-01	1	1
2021-01-02	1	1
2021-01-03	2	2
2021-01-04	1	2
2021-01-05	1	2
2021-01-06	3	3
2021-01-07	1	3
2021-01-08	2	3

谢谢！

Answer 1

您可以使用scan 运算符：https://docs.microsoft.com/en-us/azure/data-explorer/kusto/query/scan-operator

例如：

datatable(Timestamp:datetime, Count:int)
[
   datetime(2021-01-01), 1,
   datetime(2021-01-02), 1,
   datetime(2021-01-03), 2,
   datetime(2021-01-04), 1,
   datetime(2021-01-05), 1,
   datetime(2021-01-06), 3,
   datetime(2021-01-07), 1,
   datetime(2021-01-08), 2,
]
| order by Timestamp asc
| scan declare (max_to_date:int = 0) with 
(
    step s1: true => max_to_date = case(Count > s1.max_to_date,
                                        Count,
                                        s1.max_to_date);
)

Timestamp	Count	max_to_date
2021-01-01 00:00:00.0000000	1	1
2021-01-02 00:00:00.0000000	1	1
2021-01-03 00:00:00.0000000	2	2
2021-01-04 00:00:00.0000000	1	2
2021-01-05 00:00:00.0000000	1	2
2021-01-06 00:00:00.0000000	3	3
2021-01-07 00:00:00.0000000	1	3
2021-01-08 00:00:00.0000000	2	3