azure - 在 KQL azure 显示器中显示今天、昨天、一周的最佳方式

Question

我试图显示今天(9 滚动 24 小时)的计数与昨天(再次滚动)与每周平均值的计数

虽然我的代码可以工作，但我也遇到了错误

错误是(查询成功，但有警告:处理查询时出现一些错误。:“部分查询失败:未指定错误(消息:'shard:5eeb9282-0854-4569-a674-10f8daef9f7d，来源:(错误{详细信息:休息(404，“头qh1kustorageoiprdweu16.blob.core.windows.net/jgtb64673c4e98a07fa116b4e49211-0d2a81b5bf3540e087ff2cc0e4e57c98/13da174e-3951-4b54-9a45-1f 9cbe5759b4/426a5a10-4e91-4...")

代码

let Yes_End = ago(24h);
let Yes_Start = ago(48h);
let N = ago(1m);
let LW_end = ago(14d);
let Lw_start = ago(7d);

let Curr = customMetrics
|extend Dec_Reasion = tostring(customDimensions["DeclineReason"])
|extend Type = tostring(customDimensions["AcquiringInstitutionId"])
|extend dw = dayofweek(timestamp)
|where name =='TransactionsDeclined'
|where timestamp between (Yes_End..N)
|summarize CurrentVal=sum(valueCount) by tostring(Dec_Reasion);


let Trend = customMetrics
|extend Dec_Reasion = tostring(customDimensions["DeclineReason"])
|extend Type = tostring(customDimensions["AcquiringInstitutionId"])
|where timestamp between (Yes_Start .. Yes_End)
|where name =='TransactionsDeclined'
|summarize Yesterday_total=sum(valueCount) by tostring(Dec_Reasion);

let weekTrend =customMetrics
|extend Dec_Reasion = tostring(customDimensions["DeclineReason"])
|extend Type = tostring(customDimensions["AcquiringInstitutionId"])
|extend dw = dayofweek(timestamp)
|where toint(dw) <6
|where timestamp between (LW_end .. Lw_start)
|where name =='TransactionsDeclined'
|summarize Week_Avg=sum(valueCount)/5 by tostring(Dec_Reasion) ;

Curr
|join kind=leftouter Trend on Dec_Reasion
|join kind=leftouter weekTrend on Dec_Reasion
|project Dec_Reasion,CurrentVal,Yesterday_total,Week_Avg

Answer 1

这个查询可以用不需要连接的方式编写。
您可能想尝试一下。

let Yes_End = ago(24h);
let Yes_Start = ago(48h);
let N = ago(1m);
let LW_end = ago(14d);
let Lw_start = ago(7d);
customMetrics
| where     timestamp between (LW_end .. Lw_start) 
        or  timestamp between (Yes_Start .. N)
| where name == 'TransactionsDeclined'
| extend    Dec_Reasion = tostring(customDimensions["DeclineReason"])
           ,Type        = tostring(customDimensions["AcquiringInstitutionId"])
| summarize CurrentVal      = sumif(valueCount, timestamp between (Yes_End .. N)) 
           ,Yesterday_total = sumif(valueCount, timestamp between (Yes_Start .. Yes_End))
           ,Week_Avg        = sumif(valueCount, timestamp between (LW_end .. Lw_start) and where toint(dayofweek(timestamp)) < 6) / 5
            by Dec_Reasion