0

嗨，我想要实现的是将两个表之间的联合结果合并到 Log Analytics 中的单行中。

我正在两个具有不同操作名称的表之间创建联合。

那就是我试图从运行中的特定操作中获取行，与相关运行的行合并/合并。

这就是我想要实现的目标： 在此处输入图像描述

到目前为止，这是我的查询：

//Logic App Runs
AzureDiagnostics
| where OperationName in ( "Microsoft.Logic/workflows/workflowRunCompleted" )
| where workflowId_s == "/SUBSCRIPTIONS/[GUID PLACEHOLDER]/RESOURCEGROUPS/[NAME PLACEHOLDER]/PROVIDERS/MICROSOFT.LOGIC/WORKFLOWS/[NAME PLACEHOLDER]"
| where status_s == "Failed"
| extend ["Duration [sec]"]=(todouble(endTime_t - startTime_t) / 10000000)
| union (
    //Logic App Actions 
    AzureDiagnostics
    | where OperationName in ( "Microsoft.Logic/workflows/workflowActionCompleted" )
    | where workflowId_s == "/SUBSCRIPTIONS/[GUID PLACEHOLDER]/RESOURCEGROUPS/[NAME PLACEHOLDER]/PROVIDERS/MICROSOFT.LOGIC/WORKFLOWS/[NAME PLACEHOLDER]"
    | where resource_actionName_s == "Log_Exception"
    | where status_s == "Succeeded"  
    | project resource_runId_s , trackedProperties_PassId_g, trackedProperties_AccessCodes_s, trackedProperties_BookingNumber_s, trackedProperties_FlowId_g , trackedProperties_LicensePlates_s, trackedProperties_BlobUrl_s
)
| project LogicApp=resource_workflowName_s, Status=status_s, StartTime=startTime_t, EndTime=endTime_t, ["Duration [sec]"],  ResourceGroup=resource_resourceGroupName_s, RunId=resource_runId_s, PassId=trackedProperties_PassId_g, FlowId=trackedProperties_FlowId_g, AccessCodes=trackedProperties_AccessCodes_s, BookingNumber=trackedProperties_BookingNumber_s, LicensePlates=trackedProperties_LicensePlates_s, ExceptionInformation=trackedProperties_BlobUrl_s
4

1 回答 1

0

我找到了解决方案，我想：P

我只是将组合技术从联合更改为连接，并更改了连接的顺序。

//Tallin_Failed
AzureDiagnostics
    | where OperationName in ( "Microsoft.Logic/workflows/workflowActionCompleted" )
    | where workflowId_s == "/SUBSCRIPTIONS/[GUID PLACEHOLDER]/RESOURCEGROUPS/[NAME PLACEHOLDER]/PROVIDERS/MICROSOFT.LOGIC/WORKFLOWS/[NAME PLACEHOLDER]"
    | where resource_actionName_s == "Log_Exception"
    | where status_s == "Succeeded"
| join kind=rightouter  (
    //Exception_Tallin
    AzureDiagnostics
    | where OperationName in ( "Microsoft.Logic/workflows/workflowRunCompleted" )
    | where workflowId_s == "/SUBSCRIPTIONS/[GUID PLACEHOLDER]/RESOURCEGROUPS/[NAME PLACEHOLDER]/PROVIDERS/MICROSOFT.LOGIC/WORKFLOWS/[NAME PLACEHOLDER]"
    | where status_s == "Failed"
    | extend ["Duration [sec]"]=(todouble(endTime_t - startTime_t) / 10000000)
    | project LogicApp=resource_workflowName_s, resource_runId_s, workflowRunStatus=status_s, StartTime=startTime_t, EndTime=endTime_t, ["Duration [sec]"],  ResourceGroup=resource_resourceGroupName_s
) on resource_runId_s 
| project LogicApp, Status=workflowRunStatus , StartTime, EndTime, ["Duration [sec]"],  ResourceGroup, RunId=resource_runId_s , PassId=trackedProperties_PassId_g, FlowId=trackedProperties_FlowId_g, AccessCodes=trackedProperties_AccessCodes_s, BookingNumber=trackedProperties_BookingNumber_s, LicensePlates=trackedProperties_LicensePlates_s, ExceptionInformation=trackedProperties_BlobUrl_s

我还不能将此标记为答案（直到从现在开始的 2 天）...：P

于 2018-09-26T13:08:07.497 回答