Kusto:如何从不参与汇总的列中获取值?

时间:2019-01-28 22:38:37

标签: azure-log-analytics kusto azure-data-explorer

具有下表和Kusto查询,如何获得具有“购买”列的结果?

let ProductsTable = datatable(Supplier: string, Fruit: string, Price: int, Purchase: datetime)
[
    'Contoso', 'Grapes', 220, datetime(2018-10-01 01:00),
    'Fabrikam', 'Lemons', 31, datetime(2018-10-01 02:00),
    'Contoso', 'Lemons', 29, datetime(2018-10-02 03:00),
    'Contoso', 'Grapes', 210, datetime(2018-10-02 04:00),
    'Fabrikam', 'Lemons', 30, datetime(2018-10-03 05:00),
    'Contoso', 'Bananas', 12, datetime(2018-10-03 06:00),
    'Contoso', 'Bananas', 12, datetime(2018-10-04 07:00),
    'Contoso', 'Lemons', 29, datetime(2018-10-04 08:00),
    'Contoso', 'Grapes', 200, datetime(2018-10-05 09:00),
];
ProductsTable
    | summarize Price = min(Price) by Supplier, Fruit
    | order by Supplier asc, Fruit asc, Price asc

结果

Contoso Bananas 12
Contoso Grapes      200
Contoso Lemons      29
Fabrikam    Lemons      30

期望的结果

Contoso Bananas 12  2018-10-03 06:00
Contoso Grapes      200 2018-10-05 09:00
Contoso Lemons      29  2018-10-02 03:00
Fabrikam    Lemons      30  2018-10-03 05:00

我知道可能会有多个结果,例如对于 Contoso-Bananas-12 ,我们可以具有以下任意一种结果

  • 2018-10-03 0 6 :00
  • 2018-10-04 0 7 :00

2 个答案:

答案 0 :(得分:3)

尝试使用arg_min()https://docs.microsoft.com/en-us/azure/kusto/query/arg-min-aggfunction

let ProductsTable = datatable(Supplier: string, Fruit: string, Price: int, Purchase: datetime)
[
    'Contoso', 'Grapes', 220, datetime(2018-10-01 01:00),
    'Fabrikam', 'Lemons', 31, datetime(2018-10-01 02:00),
    'Contoso', 'Lemons', 29, datetime(2018-10-02 03:00),
    'Contoso', 'Grapes', 210, datetime(2018-10-02 04:00),
    'Fabrikam', 'Lemons', 30, datetime(2018-10-03 05:00),
    'Contoso', 'Bananas', 12, datetime(2018-10-03 06:00),
    'Contoso', 'Bananas', 12, datetime(2018-10-04 07:00),
    'Contoso', 'Lemons', 29, datetime(2018-10-04 08:00),
    'Contoso', 'Grapes', 200, datetime(2018-10-05 09:00),
];
ProductsTable
| summarize Price = arg_min(Price, *) by Supplier, Fruit
| order by Supplier asc, Fruit asc, Price asc

答案 1 :(得分:1)

我是Kusto的新手,但我发现下面可以通过在Kusto中​​使用 partition by row_number()返回相同的输出。

KQL:

let ProductsTable = datatable(Supplier: string, Fruit: string, Price: int, Purchase: datetime) 
[
    'Contoso', 'Grapes', 220, datetime(2018-10-01 01:00),
    'Fabrikam', 'Lemons', 31, datetime(2018-10-01 02:00),
    'Contoso', 'Lemons', 29, datetime(2018-10-02 03:00),
    'Contoso', 'Grapes', 210, datetime(2018-10-02 04:00),
    'Fabrikam', 'Lemons', 30, datetime(2018-10-03 05:00),
    'Contoso', 'Bananas', 12, datetime(2018-10-03 06:00),
    'Contoso', 'Bananas', 12, datetime(2018-10-04 07:00),
    'Contoso', 'Lemons', 29, datetime(2018-10-04 08:00),
    'Contoso', 'Grapes', 200, datetime(2018-10-05 09:00), 
]; 
ProductsTable 
| partition by Fruit 
  ( sort by Price asc   
    | extend rn = row_number(1, prev(Supplier) != Supplier)   
    | where rn == 1
  ) 
| project Supplier, Fruit, Price, Purchase 
| sort by Supplier asc, Fruit asc;    

结果:

Supplier    Fruit   Price   Purchase
Contoso     Bananas 12      2018-10-03 06:00:00.0000000
Contoso     Grapes  200     2018-10-05 09:00:00.0000000
Contoso     Lemons  29      2018-10-02 03:00:00.0000000
Fabrikam    Lemons  30      2018-10-03 05:00:00.0000000

但是,这没有Yoni L的解决方案有效。我曾经使用Redshift / PostgreSQL编写类似的查询,所以我想知道是否可以通过row_num()完成此操作,这是一个非常常见的窗口函数。