在日志分析 KQL 中获得独特的价值

Question

我想从我的查询中获取某些行的不同列，但也想返回其他列，所以我想将 distinct 和 project 结合起来，但只对我想要唯一值的列使用 distinct。或者更好地说，我希望查询只选择一个管道运行的副本，即使它运行了多次。

ADFActivityRun
| where ActivityType == "Copy" or ActivityType == "ExecuteDataFlow"
| where Status == "Succeeded" or Status == "Failed"
| project TimeGenerated, DataFactory=substring(tostring(split(ResourceId, "/", 8)), 2, strlen(tostring(split(ResourceId, "/", 8)))-4), PipelineRunId, PipelineName, ActivityName, Status, ActivityType, Start, End, ErrorMessage, FailureType, RowsRead  = parse_json(Output).rowsRead, RowsCopied = parse_json(Output).rowsCopied, rowsWritten = parse_json(Output).runStatus.metrics.sink1.rowsWritten |order by TimeGenerated desc 
| distinct PipelineName, PipelineRunId, ActivityName, Status, ActivityType, DataFactory

Answer 1

您可以使用take_any() 获取任何信息，或使用arg_max() 获取最新信息：

例如：

ADFActivityRun
| where ActivityType in ("Copy", "ExecuteDataFlow")
| where Status in ("Succeeded", "Failed")
| extend Output = parse_json(Output)
| project TimeGenerated, 
          DataFactory = substring(tostring(split(ResourceId, "/", 8)), 2, strlen(tostring(split(ResourceId, "/", 8)))-4),
          PipelineRunId,
          PipelineName,
          ActivityName,
          Status,
          ActivityType,
          Start,
          End,
          ErrorMessage,
          FailureType,
          RowsRead = Output.rowsRead,
          RowsCopied = Output.rowsCopied,
          rowsWritten = Output.runStatus.metrics.sink1.rowsWritten
| summarize arg_max(TimeGenerated, *) by PipelineRunId