嵌套查询日志分析

Question

您好我试图通过在＆＃34;其中＆＃34;中嵌套查询来获取日志事件。另一个查询。这有可能吗？

AzureDiagnostics 
| where resource_workflowName_s == "[Workflow Name]"
| where resource_runId_s == (AzureDiagnostics | where trackedProperties_PayloadID_g == "[GUID]" | distinct resource_runId_s)

Answer 1

尝试：

AzureDiagnostics 
| where resource_workflowName_s == "[Workflow Name]"
| where resource_runId_s in (
     toscalar(AzureDiagnostics 
              | where trackedProperties_PayloadID_g == "[GUID]" 
              | distinct resource_runId_s))