Question

I am trying to write an App Insights query that will report back the timespan between two known events, specifically circuit breaker open and close events. The assumption is that these events always occur in pairs, so we need to know the time between the two for every occurrence in a time period.

My first attempt was to use an inline function. Simplified version below.

let timeOpened = (timeClosed:datetime)
{
    let result = customEvents
    | where name == 'CircuitBreakerStatusChange'
    | where customDimensions['State'] == 'Open'
    | where timestamp < timeClosed
    | order by timestamp desc
    | take 1
    | project timestamp;
    let scalar = toscalar(result);  
    scalar
};
customEvents
| where timestamp > ago(4h)
| where name == 'CircuitBreakerStatusChange'
| where customDimensions['State'] == 'Closed'
| extend timeOpen = timestamp - timeOpened(timestamp)

There may be a better way to do this. If so your ideas are welcome! But in this particular attempt the only feedback I get from Azure when running this is "Syntax error". However, I don't believe there's a syntax error here because if I just change the return value of the function from scalar to now() it runs successfully. Also I can run the body of the function in isolation successfully. Any idea what's wrong here?

Answer 1

我认为您遇到语法错误，因为查询语言不允许可能的递归构造。 Now（）之所以有效，是因为它是在查询时静态（而非动态）检索的。

我认为您可以使用serialize和prev()运算符来达到预期的结果：

Table | order by timestamp asc | serialize
| extend previousTime = prev(timestamp,1)
| extend Diff = iff(customDimensions['State'] == 'Closed', timestamp - previousTime, 0)
| where Diff > 0

注意：我没有测试上面的示例，它可能需要一些额外的思想才能使其起作用（例如，在进行previousTime计算之前，请确保先前的记录实际上是“打开的”）。

Is it possible to get query results in an App Insights inline function?

1 个答案: