azure-log-analytics - 基于日期查询的 Azure 日志分析

Question

我想在 log analytics 中查询一个表，以获取今天日期最后一小时的记录计数，并比较在同一天的前一周（7 天前）同一小时获取的计数。

我不确定以下查询是否对我有帮助。请帮助我。

表1 | 其中 TimeGenerated > now(-1h) 和 responseCode_d == 200 | 通过 responseCode 总结 recount=count(responseCode) | 项目响应代码，重新计算 | 加入 kind=inner ( Table1 | where TimeGenerated > now(-7d) and responseCode_d == 200 | 通过 responseCode 总结 recount1=count(responseCode) | project responseCode_d,recount1 ) on responseCode

Answer 1

这样的事情怎么样？

Table1
| where TimeGenerated >= ago(1h) and TimeGenerated < now()
| where responseCode_d == 200
| summarize responseCountLastWeek=count() by responseCode
| project responseCode, responseCountLastWeek
| join kind=fullouter (
    Table1
    | where TimeGenerated >= ago(1h) - 7d and TimeGenerated < now() - 7d
    | responseCode_d == 200
    | summarize responseCountThisWeek=count() by responseCode
    | project responseCode, responseCountThisWeek
) on responseCode
| project
    responseCode = coalesce(responseCode, responseCode1),
    responseCountPrevWeek = coalesce(responseCountPrevWeek, 0),
    responseCountThisWeek = coalesce(responseCountThisWeek, 0)