0

我想对一组相关数据执行子选择。该子数据需要使用来自主查询的数据进行过滤：

customEvents
| extend envId = tostring(customDimensions.EnvironmentId)
| extend organisation = tostring(customDimensions.OrganisationName)
| extend version = tostring(customDimensions.Version)
| extend app = tostring(customDimensions.Appname)
| where customDimensions.EventName contains "ApiSessionStartStart"
| extend dbInfo = toscalar(
    customEvents 
    | extend dbInfo = tostring(customDimensions.dbInfo)
    | extend serverEnvId = tostring(customDimensions.EnvironmentId)
    | where customDimensions.EventName == "ServiceSessionStart" or customDimensions.EventName == "ServiceSessionContinuation"
    | where serverEnvId = envId // This gives and error
    | project dbInfo
    | take 1)
| order by timestamp desc
| project timestamp, customDimensions.OrganisationName, customDimensions.Version, customDimensions.onBehalfOf, customDimensions.userId, customDimensions.Appname, customDimensions.apiKey, customDimensions.remoteIp, session_Id , dbInfo,  envId

上述查询导致错误：

无法解析实体“envId”

如何根据envId主查询中的字段过滤子选择中的数据？

4

1 回答 1

1

我相信您需要join改用，您将加入其中以从第二个查询中获取该值

加入文档：https ://docs.loganalytics.io/docs/Language-Reference/Tabular-operators/join-operator

连接的左侧是您的“外部”查询，连接的右侧是“内部”查询，尽管您可能会执行一个更简单的查询，而不是执行 take 1，而只是获取不同的值serverEnvId, dbInfo

于 2018-01-05T20:13:55.053 回答