7

在Azure 新的日志分析查询平台中，您可以查询性能计数器并对其进行汇总，最终创建一个漂亮的图表。

遵循多维文档示例，它说

by 子句中的多个表达式创建多行，每个值组合一个。

我想在他们的示例数据库中查询每台计算机的网络字节发送和接收。从此查询开始，它应该类似于

Perf | where TimeGenerated > ago(1d) | where (CounterName == "Bytes Received/sec" or CounterName == "Bytes Sent/sec") | summarize avg(CounterValue) by bin(TimeGenerated, 1h), Computer, CounterName | extend Threshold = 20 | render timechart

问题是发送和接收字节在计算机级别的图表中分组。

如何按照文档中的说明表示多个维度，以便我将计算机 X 字节发送和计算机 X 字节接收而不是将它们组合在一起，这没有任何意义？

发送和接收的字节在图中混合

更不用说在以前的版本中它按预期工作。

4

2 回答 2

6

我认为，如果没有真正接受多个维度，则字符串连接可以解决问题。在我看来有点骇人听闻，但确实如此。

Perf
| where (CounterName == "Bytes Received/sec" or CounterName == "Bytes Sent/sec") and InstanceName matches regex "^Microsoft Hyper-V Network Adapter.*$"
| summarize avg(CounterValue) by strcat(Computer, " ", CounterName), bin(TimeGenerated, 10s)
| render timechart
于 2017-09-20T11:43:29.730 回答
0

另一种选择是这个

let RuntimeID = CosmosThroughput_CL 
| where MetricName_s == "ProvisionedThroughput" and TimeGenerated between (ago(2h) .. ago(1h))
| order by TimeGenerated desc  
| top 1 by TimeGenerated
| distinct RuntimeID_g;
CosmosThroughput_CL 
| where MetricName_s == "ProvisionedThroughput" and RuntimeID_g in (RuntimeID)
| project Resource = toupper(Resource), Value = Throughput_d, Container = Container_s, Database = Database_s, MetricName = "Provisioned"
| union 
    (
        AzureDiagnostics 
        | where ResourceProvider == "MICROSOFT.DOCUMENTDB" and Category == "PartitionKeyRUConsumption"
        | where TimeGenerated between (ago(1d) .. ago(1d-1h))
        | summarize Value = sum(todouble(requestCharge_s)) by Resource, databaseName_s, collectionName_s
        | project Resource, Container = collectionName_s, Database = databaseName_s, Value, MetricName = "HourlyUsage"
    ) 
| union 
    ( 
        AzureDiagnostics 
        | where ResourceProvider == "MICROSOFT.DOCUMENTDB" and Category == "PartitionKeyRUConsumption"
        | where TimeGenerated between (ago(1d) .. ago(1d-1h))
        | summarize Value = sum(todouble(requestCharge_s)/3600) by Resource, databaseName_s, collectionName_s
        | project Resource, Container = collectionName_s, Database = databaseName_s, Value, MetricName = "RUs"
    )
| project Resource, Database, Container, Value, MetricName

重要的部分是project相同的列名。Value保存每个表中的不同值。第二个union帮助我从同一张表中投射另一个值。

于 2020-11-07T17:34:16.273 回答