Azure Kusto 语法

Question

我需要运行一个非常简单的查询

requests 
| where cloud_RoleName == "blabla" 
| summarize Count=count() by url
| order by Count desc

我唯一需要获取过去 5 分钟的数据如果我尝试这个:

requests | where timestamp < ago(5m)
| where cloud_RoleName == "blabla" 
| summarize Count=count() by url
| order by Count desc

或者这个

requests 
| where cloud_RoleName == "blabla" and timestamp < ago(5m)
| summarize Count=count() by url
| order by Count desc

但它们都返回数据超过 5 分钟的答案。我读过文档，发现没有其他方法可以编写此查询

有人可以帮忙吗？

Answer 1

确保检查时间戳是否大于ago()的结果。它返回时间戳，例如5 分钟前，因此如果您想要最近 5 分钟内的数据，您需要时间戳高于该时间的数据。

所以查询应该是:

requests
| where timestamp > ago(5m)
| where cloud_RoleName == "blabla" 
| summarize Count=count() by url
| order by Count desc