基于日期查询的 Azure 日志分析

Question

我想在 log analytics 中查询一个表，以获取今天日期最后一小时的记录计数，并比较在同一天的前一周（7 天前）同一小时获取的计数。

我不确定以下查询是否对我有帮助。请帮帮我。

表 1 |其中 TimeGenerated > now(-1h) 和 responseCode_d == 200 |通过 responseCode 总结 recount=count(responseCode) |项目响应代码，重新计算 |加入种类=内部（ 表格1 |其中 TimeGenerated > now(-7d) 和 responseCode_d == 200 |通过 responseCode 总结 recount1=count(responseCode) |项目 responseCode_d,recount1 ) 在响应码上

Answer 1

这样的事情怎么样？

Table1
| where TimeGenerated >= ago(1h) and TimeGenerated < now()
| where responseCode_d == 200
| summarize responseCountLastWeek=count() by responseCode
| project responseCode, responseCountLastWeek
| join kind=fullouter (
    Table1
    | where TimeGenerated >= ago(1h) - 7d and TimeGenerated < now() - 7d
    | responseCode_d == 200
    | summarize responseCountThisWeek=count() by responseCode
    | project responseCode, responseCountThisWeek
) on responseCode
| project
    responseCode = coalesce(responseCode, responseCode1),
    responseCountPrevWeek = coalesce(responseCountPrevWeek, 0),
    responseCountThisWeek = coalesce(responseCountThisWeek, 0)