azure-application-insights - 如何在 azure 中检索与另一个属性相对应的自定义属性

Question

我正在尝试编写一个 kusto 查询来检索自定义属性，如下所示。

我想检索计数pkgName和对应的organization. 我可以检索 pkgName 的计数，代码附在下面。

let mainTable = union customEvents
    | extend name =replace("\n", "", name)
    | where iif('*' in ("*"), 1 == 1, name in ("*"))
    | where true;
let queryTable = mainTable;
let cohortedTable = queryTable
    | extend dimension = customDimensions["pkgName"]
    | extend dimension = iif(isempty(dimension), "<undefined>", dimension)
    | summarize hll = hll(itemId) by tostring(dimension)
    | extend Events = dcount_hll(hll)
    | order by Events desc
    | serialize rank = row_number()
    | extend dimension = iff(rank > 10, 'Other', dimension)
    | summarize merged = hll_merge(hll) by tostring(dimension)
    | project ['pkgName'] = dimension, Counts = dcount_hll(merged);
cohortedTable

请帮助我了解organization每个pkgName项目。

Answer 1

请尝试这个简单的查询：

customEvents
| summarize counts=count(tostring(customDimensions.pkgName)) by pkgName=tostring(customDimensions.pkgName),organization=tostring(customDimensions.organization)

请随时修改它以满足您的要求。

如果以上不满足您的要求，请尝试创建另一个包含pkgName和organization关系的表。然后使用join运算符连接这些表。例如：

    //create a table which contains the relationship
    let temptable = customEvents
    | summarize by pkgName=tostring(customDimensions.pkgName),organization=tostring(customDimensions.organization);
    
    //then use the join operator to join these tables on the keyword pkgName.