azure-data-explorer - Kusto - 根据存储桶值渲染柱形图（扩展运算符）

Question

如果我对以下数据表运行以下查询，则事件 _count>10 的结果仅为 10E。其他类别没有显示在存储桶中是否有任何原因。我想根据事件计数类别呈现柱形图。谢谢。

    | summarize event_count=count() by State
    | where event_count > 10
    | extend bucket = case (
    event_count > 10, "10E",
    event_count > 100, "100E",
    event_count > 500, "500E",
    event_count > 1000, "1000E",
    event_count > 5000, ">5000E",
    "N/A")
| project bucket```


datatable (State: string, event_count: long) [
    "VIRGIN ISLANDS",long(12),
    "AMERICAN SAMOA",long(16),
    "DISTRICT OF COLUMBIA",long(22),
    "LAKE ERIE",long(27),
    "LAKE ST CLAIR",long(32),
    "LAKE SUPERIOR",long(34),
    "RHODE ISLAND",long(51),
    "LAKE HURON",long(63),
    "CONNECTICUT",long(148)
]

Answer 1

当“case”函数中的条件为真时，它不会继续到下一个。由于您的所有计数都大于 10，因此第一个类别对所有计数都是正确的。您似乎希望条件小于或等于，这是一个示例：

datatable (State: string, event_count: long) [
    "VIRGIN ISLANDS",long(12),
    "AMERICAN SAMOA",long(16),
    "DISTRICT OF COLUMBIA",long(22),
    "LAKE ERIE",long(27),
    "LAKE ST CLAIR",long(32),
    "LAKE SUPERIOR",long(34),
    "RHODE ISLAND",long(51),
    "LAKE HURON",long(63),
    "CONNECTICUT",long(148)
]
    | where event_count > 10
    | extend bucket = case (
    event_count <= 10, "10E",
    event_count <= 100, "100E",
    event_count <= 500, "500E",
    event_count <= 1000, "1000E",
    event_count <= 5000, ">5000E",
    "N/A")
| summarize sum(event_count) by bucket
| render columnchart

桶	sum_event_count
100E	257
500E	148