如何捕获当前时间范围答案

【问题标题】：How to capture current timerange如何捕获当前时间范围
【发布时间】：2019-03-03 17:49:19
【问题描述】：

目标我必须查询表 1 并加入表 2 条目。

注意：- 表 2 中的事件发生在表 1 之前，所以我想确保当我查询表 2 时 startTime 小于 1 天或几个小时。

但是，我似乎无法传递时间上下文。我尝试了几种方法，但都失败了。

let minTime = customEvents | summarize min(timestamp) by appId | project min_timestamp;
let startTime = toscalar(minTime);

customEvents
 | where timestamp <= todatetime(startTime) 
 | take 10 ;

例如，上面的查询只返回表中的第一个条目。

【问题讨论】：

请详细说明您的 ASK，您需要什么类型的查询，我假设您需要 KQL 查询？你想在哪里访问时间戳？是否在应用程序洞察中的 Azure 数据资源管理器中？

标签： azure-application-insights kql

【解决方案1】：

您可以尝试以下方法：

let customEvents = datatable(appId: string, timestamp:datetime, message:string)
[
    "A", datetime(2019-03-08 16:14:50), "Hello from 'A'",
    "A", datetime(2019-03-08 15:14:50), "Hello from 'A'",
    "A", datetime(2019-03-08 14:14:50), "Hello from 'A'",
    "A", datetime(2019-03-08 13:14:50), "Hello from 'A'",
    "B", datetime(2019-03-08 12:14:50), "Hello from 'B'",
    "B", datetime(2019-03-08 11:14:50), "Hello from 'B'",    
    "D", datetime(2019-03-08 10:14:50), "Hello from 'D'",
    "C", datetime(2019-03-08 09:14:50), "Hello from 'C'",    
    "D", datetime(2019-03-08 08:14:50), "Hello from 'D'",
    "C", datetime(2019-03-08 07:14:50), "Hello from 'C'",    
]
;
let minTimeByAppId = toscalar(
    customEvents 
    | summarize min(timestamp) by appId 
    | summarize make_bag(pack(appId, min_timestamp)))
;
let otherTable = datatable(appId:string, timestamp:datetime, otherMessage:string)
[
    "A", datetime(2019-03-08 16:14:50), "Another hello from 'A'",
    "A", datetime(2019-03-07 16:14:50), "Another hello from 'A'",
    "B", datetime(2019-03-07 16:14:50), "Another hello from 'B'",
    "B", datetime(2019-03-08 16:14:50), "Another hello from 'B'",
    "C", datetime(2019-03-08 16:14:50), "Another hello from 'C'",
    "C", datetime(2019-03-08 16:14:50), "Another hello from 'C'",
    "D", datetime(2019-03-09 16:14:50), "Another hello from 'D'",
    "D", datetime(2019-03-08 16:14:50), "Another hello from 'D'",
]
;
otherTable
| where timestamp < minTimeByAppId[appId] // you could also add some 'delta' here

将输出：

| appId | timestamp                   | otherMessage           |
|-------|-----------------------------|------------------------|
| A     | 2019-03-07 16:14:50.0000000 | Another hello from 'A' |
| B     | 2019-03-07 16:14:50.0000000 | Another hello from 'B' |

【讨论】：