kql - Kusto 设置查询的变量输出

Question

希望定义一个变量来保存查询的输出，然后从中查询跟踪。像这样:

let start=datetime("2020-10-07T15:01:00.000Z");
let end=datetime("2020-10-09T13:20:00.000Z");
let timeGrain=1h;
let dataset = dependencies
| where timestamp > start and timestamp < end and ['type'] == 'HTTP' and success == false
| where name contains "mgw/capture"
| project operation_ParentId
traces
| join kind=inner(dataset) on operation_ParentId

这可能吗？

Answer 1

是的，这是可能的，您甚至几乎做对了，您只是在相关 let 语句的末尾缺少一个 ;。

试试这个:

let start=datetime("2020-10-07T15:01:00.000Z");
let end=datetime("2020-10-09T13:20:00.000Z");
let timeGrain=1h;
let dataset = dependencies
| where timestamp > start and timestamp < end and ['type'] == 'HTTP' and success == false
| where name contains "mgw/capture"
| project operation_ParentId;
traces
| join kind=inner(dataset) on operation_ParentId