azure - KQL 如何将数据分割成更小的 block

Question

我有这个查询，但输出返回 106K 记录，我需要添加到查询中的内容是执行较小的 block 以提取数据并导出到 CSV。

Resources
| where type == 'microsoft.compute/virtualmachines'
| extend
            JoinID = toupper(id),
            VMName = tostring(properties.osProfile.computerName),
            OSType = tostring(properties.storageProfile.osDisk.osType),
            VMSize = tostring(properties.hardwareProfile.vmSize),
OSVersion = tostring(properties.extended.instanceView.osVersion),
OSName = tostring(properties.extended.instanceView.osName)
| join kind=leftouter(
            Resources
            | where type == 'microsoft.compute/virtualmachines/extensions'
            | extend 
                            VMId = toupper(substring(id, 0, indexof(id, '/extensions'))),
                            ExtensionType = properties.type,
    ExtensionPublisher = properties.publisher
    ) on $left.JoinID == $right.VMId

azure graph explorer或kql有数据导出数据限制吗？

我已根据建议修改了查询，并且对我有用。

   Resources
    | where type == 'microsoft.compute/virtualmachines'
    | extend
            JoinID = toupper(id),
            VMName = tostring(properties.osProfile.computerName),
            OSType = tostring(properties.storageProfile.osDisk.osType),
            VMSize = tostring(properties.hardwareProfile.vmSize),
    OSVersion = tostring(properties.extended.instanceView.osVersion),
    OSName = tostring(properties.extended.instanceView.osName)
    | join kind=leftouter(
           Resources
            | where type == 
    'microsoft.compute/virtualmachines/extensions'
            | extend 
                            VMId = toupper(substring(id, 0, indexof(id, 
     '/extensions'))),
                            ExtensionPublisher = properties.publisher,
                            Extension_Publisher  = 
      tostring(properties.publisher),
                            ExtensionType =  properties.type
      ) on $left.JoinID == $right.VMId
      | project-away  identity1, kind, managedBy, sku, identity, 
       zones,extendedLocation,extendedLocation1, kind1, managedBy1, 
      sku1, tags1, zones1, systemData1,tags,
      systemData, tenantId, JoinID, id1, id, VMName, location1, 
      tenantId1, OSType, type1, apiVersion1, VMId,  apiVersion, plan1,

扩展发布者|按 Extension_Publisher asc 排序|扩展行号 = 行号()|其中行号 > 0|拿200

Answer 1

您可以扩展行号并按该字段进行筛选以分页(偏移)，然后获取(或限制)所需的记录数量。

Resources
  ...
  | serialize 
  | extend row_number = row_number()
  | where row_number > 10000
  | take 5000

此查询返回从 10001 到 15000 的 5000 条记录。

编辑:

正如 @david-דווו-markovitz 在评论中评论的那样，查询在调用之间应该保持一致。因此，您应该使用 order by 子句准备主查询(省略号部分)，并确保即使数据源随时间发生变化(例如，使用时间间隔)也能检索到相同的记录。