azure - KQL 负载均衡器字节

Question

嗨，我一直在尝试将查询从字节转换为 GB，但是我得到了一些奇怪的结果。我还得到相同的组件，其大小逐渐增加，这是有意义的，因为我们正在获取使用的字节，我们希望看到增加的字节，但我只想要最新的数据集(当查询运行时)。谁能看出我哪里出错了？

AzureMetrics
| where TimeGenerated >=ago(1d)
| where Resource contains "LB"
| where MetricName contains "ByteCount"
| extend  TotalGB = Total/1024
| summarize by Resource, TimeGenerated, TotalGB, MetricName, UnitName
| sort by TotalGB desc 
| render piechart

在下表中，它显示了 loadbal-1 在一个短窗口中多次报告，对于 loadbal2 和 13 也是如此。我想将这些全部捕获在一行中，而且我认为我可能搞砸了“TotalGB”的查询(将字节转换为 GB)

Answer 1

I would only like the latest set of data (when the query was run)

您可以使用arg_max()聚合函数。

例如:

AzureMetrics
| where TimeGenerated >= ago(1d)
| where Resource has "LoadBal"
| where MetricName == "ByteCount"
| summarize arg_max(TimeGenerated, *) by Resource

<小时/>

I've been trying to convert a query from bytes to GB, however I'm getting some strange results... I think I might have messed up the query for "TotalGB" (converting bytes to GB)

如果原始数据以字节为单位，则需要除以exp2(30) (或 1024*1024*1024 )以获取 GB 值。

或者，您可以使用 format_bytes()函数代替

例如:

print bytes = 18027051483.0
| extend gb_1 = format_bytes(bytes, 2),
         gb_2 = bytes/exp2(30),
         gb_3 = bytes/1024/1024/1024

<表类=“s-表”><标题>字节gb_1gb_2gb_3 <正文>1802705148316.79 GB16.788999999873316.7889999998733