是否可以更好地优化我的 kusto 查询答案

【问题标题】：is it possible for better optimization of my kusto query是否可以更好地优化我的 kusto 查询
【发布时间】：2020-04-16 23:07:25
【问题描述】：

下面是我的 Kusto 查询，在镜头仪表板中显示数据需要 2 分钟以上，我已经优化了我的查询以在 let 语句中包含 materialize() 并包含 has。有没有其他方法可以更好地优化它。

let C_masfunteams = materialize(find withsource=source in (cluster(X).database('oci-*').['TextFileLogs'])     where AttemptedIngestTime > ago(7d)
and FileLineContent  has "<li>Build Number:"  | summarize min(AttemptedIngestTime) by source, FileLineContent);//, AttemptedIngestTime
let n = C_masfunteams | extend databaseName = extract(@"""(oci-[^""]*)""", 1, source)
| extend BuildNumber = extract(@"([A-Z]\w*\.[0-9]\d*\.[0-9]\d*\.[0-9]\d*)",1,FileLineContent)
| extend StampVersion = extract(@"([0-9]\d*\.[0-9]\d*\.[0-9]\d*\.[0-9]\d*)",1,FileLineContent)
|extend cluster ='masfunteams'
| project BuildNumber , StampVersion , min_AttemptedIngestTime
|  summarize NumberOfRuns=count() , ingestedtime = min(min_AttemptedIngestTime) by BuildNumber,StampVersion;
let C_masfun= materialize(find withsource=source in (cluster(Y).database('oci-*').['TextFileLogs'])     where AttemptedIngestTime > ago(7d)
and FileLineContent  has "<li>Build Number:"  | summarize min(AttemptedIngestTime) by source, FileLineContent);//, AttemptedIngestTime
let m = C_masfun | extend databaseName = extract(@"""(oci-[^""]*)""", 1, source)
| extend BuildNumber = extract(@"([A-Z]\w*\.[0-9]\d*\.[0-9]\d*\.[0-9]\d*)",1,FileLineContent)
| extend StampVersion = extract(@"([0-9]\d*\.[0-9]\d*\.[0-9]\d*\.[0-9]\d*)",1,FileLineContent)
|extend cluster ='masfunteams'
| project BuildNumber , StampVersion , min_AttemptedIngestTime
|  summarize NumberOfRuns=count() , ingestedtime = min(min_AttemptedIngestTime) by BuildNumber,StampVersion;
let C_masvaas = materialize(find withsource=source in (cluster(z).database('oci-*').['TextFileLogs'])     where AttemptedIngestTime > ago(7d)
and FileLineContent  has "<li>Build Number:"  | summarize min(AttemptedIngestTime) by source, FileLineContent);//, AttemptedIngestTime
let o= C_masvaas | extend databaseName = extract(@"""(oci-[^""]*)""", 1, source)
| extend BuildNumber = extract(@"([A-Z]\w*\.[0-9]\d*\.[0-9]\d*\.[0-9]\d*)",1,FileLineContent)
| extend StampVersion = extract(@"([0-9]\d*\.[0-9]\d*\.[0-9]\d*\.[0-9]\d*)",1,FileLineContent)
|extend cluster ='masfunteams'
| project BuildNumber , StampVersion , min_AttemptedIngestTime
|  summarize NumberOfRuns=count() , ingestedtime = min(min_AttemptedIngestTime) by BuildNumber,StampVersion;
union isfuzzy=true  m,n,o
| summarize Ingestedtime =min(ingestedtime) by BuildNumber,StampVersion

【问题讨论】：

标签： azure-data-explorer kql

【解决方案1】：

您好，查询非常复杂，如果不在实际集群上运行它，很难弄清楚预期的结果是什么。所以这里有一些提示：

考虑将联合运算符作为第一个具有统一逻辑用于过滤、解析和汇总操作的运算符
如果您只使用每个数据集一次，请考虑删除 materialize()
考虑删除“find”，因为您没有跨多个列进行搜索，如果您使用它来获取输出记录集中的源表，请考虑将“withsource”添加到联合语句中
如果可能，请考虑使用“解析”运算符而不是正则表达式

希望这会有所帮助！

【讨论】：

谢谢@avnera