azure-data-explorer - 库斯托 |用 where 子句总结 count() 多列

Question

我正在尝试获取 Kusto 查询中多项内容的数量，但无法正常工作。假设我有一个这样的示例表:

let SampleTable = datatable(Department:string, Status:string, DateStamp:datetime) 
[
   "Logistics", "Open", "05-01-2019",
   "Finance", "Closed", "05-01-2020",
   "Logistics", "Open", "05-01-2020"
];

我这样查询:

SampleTable
| summarize closedEntries = count() by (Status | where Status == "Closed"), 
    openEntries = (Status | where Status == "Open"),
    recentDates = (DateStamp | where DateStamp > "12-31-2019"),
    Department

预期成绩:

但这会产生错误“名称‘状态’未引用任何已知的列、表、变量或函数。”和 DateStamp 相同的错误。我也试过使用扩展和连接，但它是一团糟。

Answer 1

您可以使用 countif() 聚合函数:https://docs.microsoft.com/en-us/azure/data-explorer/kusto/query/countif-aggfunction

datatable(Department:string, Status:string, DateStamp:datetime) 
[
   "Logistics", "Open", "05-01-2019",
   "Finance", "Closed", "05-01-2020",
   "Logistics", "Open", "05-01-2020"
]
| summarize closedEntries = countif(Status == "Closed"),
            openEntries = countif(Status == "Open"),
            recentDates = countif(DateStamp > datetime(12-31-2019))
         by Department