Azure 数据资源管理器 Kusto：按日期时间进行分组

Question

有没有办法在 Data Explorer Kusto 中按列查找日期时间差异分组？我想了解每位旅行者在西班牙花费的总时间。

从到达该国家到到达下一个目的地的这段时间，旅行者都被视为在该国家/地区。以下是边缘情况：

• 如果 TripComplete == 'Yes' 并且该国家/地区是最后访问的目的地，则差值，旅行正在进行，花费的时间应该是 now() 和进入时间之间的差值。
• 如果 TripComplete == 'No' 并且该国家/地区是最后访问的目的地，则视为行程结束。 以西班牙为例，在西班牙度过的时间应该是旅行者在之前的旅行中在西班牙度过的时间 + 自他们上次进入该西班牙城市以来的时间（now() - EntryTime）。

这是预期的结果。

TravellerId result
1           05:00:00        [Madrid to Barcelona + Barcelona to London]
2           00:00:00        [Trip complete]
3           1.00:00:00      [now() - Malaga EntryTime]
4           05:00:00        [now() - Malaga EntryTime]
5           2:00:00         [Malaga to London]
6           1.16:00:00      [Madrid to Barcelona + (now() - Barcelona EntryTime)]
7           11:00:00        [Madrid to London + Barcelona to Beiging]

来源：

set query_now = datetime(2020-02-04 5:00:00);
datatable(TravellerId:int, Country:string, City:string, TripComplete:string, EntryTime: datetime)
[
  1, 'China', 'Beiging', 'Yes', datetime(2020-02-02 12:00:00),
  1, 'Spain', 'Madrid', 'Yes',datetime(2020-02-02 13:00:00),
  1, 'Spain', 'Barcelona', 'Yes',datetime(2020-02-02 15:00:00),
  1, 'UK', 'London', 'Yes', datetime(2020-02-02 18:00:00),
  2, 'Spain', 'Malaga', 'Yes', datetime(2020-02-03 5:00:00),
  3, 'Spain', 'Malaga', 'No', datetime(2020-02-03 5:00:00),
  4, 'China', 'Beiging', 'No', datetime(2020-02-03 5:00:00),
  4, 'Spain', 'Malaga', 'No', datetime(2020-02-04 00:00:00),
  5, 'China', 'Beiging', 'No', datetime(2020-02-01 5:00:00),
  5, 'Spain', 'Malaga', 'No', datetime(2020-02-02 5:00:00),
  5, 'UK', 'London', 'No', datetime(2020-02-02 7:00:00),
  6, 'China', 'Beiging', 'No', datetime(2020-02-02 12:00:00),
  6, 'Spain', 'Madrid', 'No',datetime(2020-02-02 13:00:00),
  6, 'Spain', 'Barcelona', 'No',datetime(2020-02-02 14:00:00),
  7, 'Spain', 'Madrid', 'Yes',datetime(2020-02-02 13:00:00),
  7, 'UK', 'London', 'Yes', datetime(2020-02-02 18:00:00),
  7, 'Spain', 'Barcelona', 'Yes',datetime(2020-02-03 15:00:00),  
  7, 'China', 'Beiging', 'Yes', datetime(2020-02-03 21:00:00), 
]
| order by TravellerId asc, TripComplete asc
//Incorrect because next() calculation should be limited to the same traveler. 
//Should be something like - if tripComplete = Yes then nextEntry = next(EntryTime, 1, now()) else, nextEntry = next(EntryTime, 1, EntryTime)
| extend nextEntry = next(EntryTime, 1, now())
| extend diffNext = nextEntry - EntryTime
| where Country == "Spain"
| summarize TimeSpentInSpain = sum(diffNext) by TravellerId

Answer 1

您可以尝试以下方法：

set query_now = datetime(2020-02-04 5:00:00);
datatable(TravellerId:int, Country:string, City:string, TripComplete:string, EntryTime: datetime)
[
  1, 'China', 'Beiging', 'Yes', datetime(2020-02-02 12:00:00),
  1, 'Spain', 'Madrid', 'Yes',datetime(2020-02-02 13:00:00),
  1, 'Spain', 'Barcelona', 'Yes',datetime(2020-02-02 14:00:00),
  1, 'UK', 'London', 'Yes', datetime(2020-02-02 15:00:00),
  2, 'Spain', 'Malaga', 'No', datetime(2020-02-03 5:00:00),
]
| order by TravellerId asc, EntryTime asc
| extend diff = EntryTime - prev(EntryTime)
| where Country == "Spain"
| summarize result = sumif(diff, TripComplete == "Yes") + sumif(now() - EntryTime, TripComplete != "Yes") by TravellerId