azure-data-explorer - Kusto row_cumsum 修改 Term 如果 Term 达到一个点

Question

我按以下顺序列出了员工姓名和薪水

我需要以以下格式创建输出表。即，每当累计工资总额超过 3000 时，我必须检测到并标记该行。

我试图做 row_cumsum 并在Term超过 3000 后重置它，但它不适用于第二次迭代。

datatable (name:string, month:int, salary:long)
[
    "Alice", 1, 1000,
    "Alice", 2, 2000,
    "Alice", 3, 1400,
    "Alice", 3, 1400,
    "Alice", 3, 1400,
]
| order by name asc, month asc
| extend total=row_cumsum(salary) 
| extend total=iff(total >=3000,total-prev(total),total)

Answer 1

现在可以使用扫描运算符：

datatable (name:string, salary:long)
[
    "Alice", 1000,
    "Alice", 2000,
    "Alice", 1400,
    "Alice", 1400,
    "Alice", 1400,
    "Alice", 1000,
    "Bob", 2400,
    "Bob", 1000,
    "Bob", 1000
]
| sort by name asc
| scan declare (total:long) with 
(
    step s: true => total = iff(isnull(s.total) or name != s.name, salary, iff(s.total < 3000, s.total + salary, salary));
)
| extend boundary_detected = iff(total >= 3000, 1, long(null))

姓名	薪水	全部的	边界检测到
爱丽丝	1000	1000
爱丽丝	2000	3000	1
爱丽丝	1400	1400
爱丽丝	1400	2800
爱丽丝	1400	4200	1
爱丽丝	1000	1000
鲍勃	2400	2400
鲍勃	1000	3400	1
鲍勃	1000	1000