1

我在 kusto 语言中有以下查询：

    AzureActivity
| where ResourceProvider == "Microsoft.Compute"
| where OperationName in ('Deallocate Virtual Machine','Start Virtual Machine')
| where ActivityStatus == 'Succeeded'
| order by Resource asc, EventSubmissionTimestamp asc
| extend IsSameResource = (prev(Resource) == Resource)
| extend PrevState = iif(IsSameResource, prev(OperationName), OperationName), CurrentState = OperationName
| extend RunTime = iif(PrevState == 'Start Virtual Machine' and CurrentState == 'Deallocate Virtual Machine', EventSubmissionTimestamp - prev(EventSubmissionTimestamp), time(null)), StartTime = prev(EventSubmissionTimestamp)
| where isnotnull(RunTime)
| project Resource, StartDate= format_datetime(todatetime(StartTime), 'MM/yyyy'),  StopDate=format_datetime(todatetime(EventSubmissionTimestamp), 'MM/yyyy'),
RuntimeThisMonth= iif( format_datetime(todatetime(StartTime), 'MM/yyyy') != format_datetime(todatetime(EventSubmissionTimestamp), 'MM/yyyy') , (datetime_diff('minute',todatetime(EventSubmissionTimestamp) ,startofmonth(EventSubmissionTimestamp)) / 60) ,(datetime_diff('minute',todatetime(EventSubmissionTimestamp) ,todatetime(StartTime)) / 60)) ,
  RuntimeLastMonth=iif( format_datetime(todatetime(StartTime), 'MM/yyyy') != format_datetime(todatetime(EventSubmissionTimestamp), 'MM/yyyy') , (datetime_diff('minute',startofmonth(EventSubmissionTimestamp) ,todatetime(StartTime)) / 60) ,0)

这给了我以下结果。 在此处输入图像描述

现在我想旋转我得到这种表的日期。

在此处输入图像描述

在之前的项目中，我使用 evaluate pivot 命令旋转列并对 Runtimes 求和，但现在我必须对列（上个月和本月）进行旋转，但我找不到旋转两列的方法。

| evaluate pivot(StartDate, sum(RuntimeLastMonth) , StopDate , sum(RuntimeThisMonth))

有人知道我在数据透视查询中缺少什么吗？

4

1 回答 1

0

这可能会起作用：

datatable(Resource:string, StartDate:datetime, StopDate:datetime, RuntimeThisMonth:long, RuntimeLastMonth:long)
[
    "A", datetime(2019-05-01), datetime(2019-05-01), 33, 0,
    "C", datetime(2019-05-01), datetime(2019-05-01), 0,  0,
    "A", datetime(2019-05-01), datetime(2019-05-01), 9,  0,
    "C", datetime(2019-04-01), datetime(2019-05-01), 69, 48,
    "D", datetime(2019-04-01), datetime(2019-05-01), 69, 48,
]
| where RuntimeLastMonth > 0 or RuntimeThisMonth > 0
| summarize RuntimeLastMonth = sum(RuntimeLastMonth), RuntimeThisMonth = sum(RuntimeThisMonth) by StartDate, StopDate, Resource
| project Resource, p = pack(
    format_datetime(StopDate, "MM/yyyy"), RuntimeThisMonth, 
    format_datetime(StartDate, "MM/yyyy"), RuntimeLastMonth)
| evaluate bag_unpack(p)

➡</p> 

| Resource | 05/2019 | 04/2019 |
|----------|---------|---------|
| A        | 42      |         |
| C        | 69      | 48      |
| D        | 69      | 48      |
于 2019-05-10T15:52:12.743 回答