-1

我有 WVD 的日志。我想获得一天内连接的平均持续时间。到目前为止，我得到了这个代码

datatable(Timestamp:datetime, User:string, State:string)
[ 
    datetime(10/23/2019, 7:02:02.527 AM), 'user1', 'Started', , 
    datetime(10/23/2019, 7:02:09.244 AM), 'user1', 'Connected', 
    datetime(10/23/2019, 7:14:21.156 AM), 'user1', 'Completed', 
    datetime(10/23/2019, 7:29:27.195 AM), 'user1', 'Started', 
    datetime(10/23/2019, 7:29:30.544 AM), 'user1', 'Connected', 
    datetime(10/23/2019, 7:45:35.438 AM), 'user1', 'Completed', 
]
| where State == "Started" or State == "Completed"
| where datetime_part("dayOfYear",TimeGenerated) == datetime_part("dayOfYear",todatetime('2020-06-25 01:02:03.7654321'))
| summarize arg_max(TimeGenerated, *) by State, UserName
| order by UserName asc, TimeGenerated asc 
| extend duration = iff(UserName == prev(UserName), TimeGenerated - prev(TimeGenerated), 0s)
| summarize avg(duration) by UserName, State
| where State == "Completed"

我想获得每个用户和每个连接的所有完成开始时间之间的平均时间

谢谢！

4

1 回答 1

1

你可以尝试这样的事情：

datatable(Timestamp:datetime, User:string, State:string)
[ 
    datetime(10/23/2019, 7:02:02.527 AM), 'user1', 'Started', 
    datetime(10/23/2019, 7:02:09.244 AM), 'user1', 'Connected', 
    datetime(10/23/2019, 7:14:21.156 AM), 'user1', 'Completed', 
    datetime(10/23/2019, 7:29:27.195 AM), 'user1', 'Started', 
    datetime(10/23/2019, 7:29:30.544 AM), 'user1', 'Connected', 
    datetime(10/23/2019, 7:45:35.438 AM), 'user1', 'Completed', 
]
| where State == "Started" or State == "Completed"
| where startofday(Timestamp) == datetime(2019-10-23)
| order by User asc, Timestamp asc 
| extend duration = iff(User == prev(User) and State == 'Completed' and prev(State) == "Started", Timestamp - prev(Timestamp), timespan(null))
| where isnotnull(duration)
| summarize avg(duration) by User // you can remove the 'by User' if you don't need it. it wasn't completely clear from your question
于 2020-06-29T17:04:47.043 回答