azure - PowerShell Invoke-AzOperationalInsightsQuery 需要在 100 秒或更短的时间内完成

Question

我正在为 Azure 编写以下 PowerShell 脚本，我需要 Invoke-AzOperationalInsightsQuery 才能在 100 秒或更短的时间内完成。我怎样才能让这个查询更快地返回结果？

$startTime = (Get-Date).ToUniversalTime().AddDays(-1).Date
    $endTime = $startTime.AddDays(1)
    
    # $query = "Union Event, Syslog"
    $query = "AzureNetworkAnalytics_CL | where SubType_s == 'FlowLog'"
    # $query = "AzureDiagnostics | where Category == "ApplicationGatewayFirewallLog"
    
    # $table = "Syslog"
    # $table = "Event"
    # $table = "AzureDiagnostics"
    # $table = "AzureNetworkAnalytics_CL"
    
    # [System.Net.ServicePointManager]::MaxServicePointIdleTime = 180000
    
    # $results = Invoke-AzOperationalInsightsQuery -WorkspaceId $workspaceID -Query $table
    # $results = Invoke-AzOperationalInsightsQuery -WorkspaceId $workspaceID -Query $table -Timespan (New-TimeSpan -Hours 2)
    # $results = Invoke-AzOperationalInsightsQuery -WorkspaceId $workspaceID -Query $table -Timespan (New-TimeSpan -Hours 24)
    $results = Invoke-AzOperationalInsightsQuery -WorkspaceId $workspaceID -Query $query -Timespan (New-TimeSpan -Start $startTime -End $endTime)
    # $results = Invoke-AzOperationalInsightsQuery -WorkspaceId $WorkspaceID -Query $Query -ExpandProperty Results
    
    # $csvFileName = "$((Get-Date).Year)$((Get-Date).Month.ToString('00'))$((Get-Date).Day.ToString('00'))$((Get-Date).Hour.ToString('00'))$((Get-Date).Minute.ToString('00'))$((Get-Date).Second.ToString('00'))-$table"
    $csvFileName = "$((Get-Date).Year)$((Get-Date).Month.ToString('00'))$((Get-Date).Day.ToString('00'))$((Get-Date).Hour.ToString('00'))-$table"
    
    $Results.Results | Export-Csv -Path "$csvFileName.csv"
    $Results.Results | ConvertTo-Json | Out-File -FilePath "$csvFileName.json"
    
    $compress = @{
        LiteralPath= ".\$csvFileName.csv",".\$csvFileName.json"
        # CompressionLevel = "Fastest"
        DestinationPath = ".\$csvFileName.zip"
    }
    Compress-Archive @compress -Force

Answer 1

I need Invoke-AzOperationalInsightsQuery to complete 100 seconds or less. How can I make this query return results faster?

通常，根据查询的复杂性，查询需要时间。

Invoke-AzOperationalInsightsQuery 有一个名为 -wait 的参数，您可以使用它来增加时间以避免超时>.

Invoke-AzOperationalInsightsQuery 使用 .NET HttpClient 发送请求，默认超时为 100 秒。

要减少 Invoke-AzOperationalInsightsQuery 的结果时间，您必须高效地编写查询。或者您可以使用-wait参数来完成结果。

$queryResults = Invoke-AzOperationalInsightsQuery -WorkspaceId "<Work space ID>" -Query "union * | take 10" -Timespan (New-TimeSpan -Hours 24) -wait 150
$queryResults.Results

MS-DOC用于优化查询以减少执行时间