日志分析-是否可以将行合并到同一列ID的单行中

Question

嗨，我要实现的目标是将两个表之间的并集结果合并到Log Analytics中的单行中。

我正在创建两个具有不同操作名称的表之间的联合。

那是我正在尝试从运行中的特定操作中获取行，并将其与相关运行的行合并/合并。

这是我要实现的目标：

这是我到目前为止的查询：

//Logic App Runs
AzureDiagnostics
| where OperationName in ( "Microsoft.Logic/workflows/workflowRunCompleted" )
| where workflowId_s == "/SUBSCRIPTIONS/[GUID PLACEHOLDER]/RESOURCEGROUPS/[NAME PLACEHOLDER]/PROVIDERS/MICROSOFT.LOGIC/WORKFLOWS/[NAME PLACEHOLDER]"
| where status_s == "Failed"
| extend ["Duration [sec]"]=(todouble(endTime_t - startTime_t) / 10000000)
| union (
    //Logic App Actions 
    AzureDiagnostics
    | where OperationName in ( "Microsoft.Logic/workflows/workflowActionCompleted" )
    | where workflowId_s == "/SUBSCRIPTIONS/[GUID PLACEHOLDER]/RESOURCEGROUPS/[NAME PLACEHOLDER]/PROVIDERS/MICROSOFT.LOGIC/WORKFLOWS/[NAME PLACEHOLDER]"
    | where resource_actionName_s == "Log_Exception"
    | where status_s == "Succeeded"  
    | project resource_runId_s , trackedProperties_PassId_g, trackedProperties_AccessCodes_s, trackedProperties_BookingNumber_s, trackedProperties_FlowId_g , trackedProperties_LicensePlates_s, trackedProperties_BlobUrl_s
)
| project LogicApp=resource_workflowName_s, Status=status_s, StartTime=startTime_t, EndTime=endTime_t, ["Duration [sec]"],  ResourceGroup=resource_resourceGroupName_s, RunId=resource_runId_s, PassId=trackedProperties_PassId_g, FlowId=trackedProperties_FlowId_g, AccessCodes=trackedProperties_AccessCodes_s, BookingNumber=trackedProperties_BookingNumber_s, LicensePlates=trackedProperties_LicensePlates_s, ExceptionInformation=trackedProperties_BlobUrl_s 

Answer 1

我找到了解决方案，我认为：P

我只是将组合技术从并集更改为联接，并且改变了联接的顺序。

//Tallin_Failed
AzureDiagnostics
    | where OperationName in ( "Microsoft.Logic/workflows/workflowActionCompleted" )
    | where workflowId_s == "/SUBSCRIPTIONS/[GUID PLACEHOLDER]/RESOURCEGROUPS/[NAME PLACEHOLDER]/PROVIDERS/MICROSOFT.LOGIC/WORKFLOWS/[NAME PLACEHOLDER]"
    | where resource_actionName_s == "Log_Exception"
    | where status_s == "Succeeded"
| join kind=rightouter  (
    //Exception_Tallin
    AzureDiagnostics
    | where OperationName in ( "Microsoft.Logic/workflows/workflowRunCompleted" )
    | where workflowId_s == "/SUBSCRIPTIONS/[GUID PLACEHOLDER]/RESOURCEGROUPS/[NAME PLACEHOLDER]/PROVIDERS/MICROSOFT.LOGIC/WORKFLOWS/[NAME PLACEHOLDER]"
    | where status_s == "Failed"
    | extend ["Duration [sec]"]=(todouble(endTime_t - startTime_t) / 10000000)
    | project LogicApp=resource_workflowName_s, resource_runId_s, workflowRunStatus=status_s, StartTime=startTime_t, EndTime=endTime_t, ["Duration [sec]"],  ResourceGroup=resource_resourceGroupName_s
) on resource_runId_s 
| project LogicApp, Status=workflowRunStatus , StartTime, EndTime, ["Duration [sec]"],  ResourceGroup, RunId=resource_runId_s , PassId=trackedProperties_PassId_g, FlowId=trackedProperties_FlowId_g, AccessCodes=trackedProperties_AccessCodes_s, BookingNumber=trackedProperties_BookingNumber_s, LicensePlates=trackedProperties_LicensePlates_s, ExceptionInformation=trackedProperties_BlobUrl_s

尽管如此，我仍无法将其标记为答案（直到现在2天之内）：P