Kusto语言。仅当时间上的先前值不同时才获得一个值

Question

我非常模糊的标题的上下文：我有4个虚拟机，它们将其日志发送给应用程序洞察。 我检索日志并将其转换为使用Kusto语言的表格。

结果表

Query: 
AzureActivity
| where ResourceProvider == "Microsoft.Compute" and ActivityStatus == "Succeeded" and OperationName == "Deallocate Virtual Machine"
| project DeallocateResource=Resource ,DeallocatedDate=format_datetime(EventSubmissionTimestamp, 'yyyy-MM-dd') ,DeallocatedTime=format_datetime(EventSubmissionTimestamp, 'HH:mm:ss')
| join kind=fullouter
(
AzureActivity
| where ResourceProvider == "Microsoft.Compute" and ActivityStatus == "Succeeded" and OperationName == "Start Virtual Machine"
| project StartupResource=Resource ,StartDate=format_datetime(EventSubmissionTimestamp, 'yyyy-MM-dd') ,StartTime=format_datetime(EventSubmissionTimestamp, 'HH:mm:ss')
)
on $right.StartupResource == $left.DeallocateResource
| where StartDate == DeallocatedDate
| project Resource=coalesce(StartupResource, DeallocateResource) ,
Date=format_datetime(todatetime(coalesce(StartDate, DeallocatedDate)), 'dd/MM/yyyy' ) 
 , StartTime= StartTime ,StopTime=DeallocatedTime , 
Runtime_Hours = format_datetime(datetime_add('minute',datetime_diff('minute', todatetime(strcat(StartDate , " " , DeallocatedTime )) , todatetime(strcat(StartDate , " " , StartTime ))), make_datetime(2017,1,1)), 'hh:mm') 
| sort by Date asc , Resource asc

如您所见，当VM在8:15启动并在8:58停止并具有12:43小时的运行时时，运行时是不正确的，那么出了点问题。在VM的活动日志中，我看到一些同事对VM做了一些奇怪的事情。然后启动了几次（他再次启动一分钟后，当您同时单击启动按钮两次时，可能会出现故障）。

活动日志

我确实找到了解决我的问题的理论方法：    我的查询需要更改，以便仅在VM启动并随后停止时才需要在时间表中记录运行时间，甚至开始和停止时间。但是atm我得到了所有“启动虚拟机”和所有“停止虚拟机”，然后将它们排序在一个表中，这会导致结果表混乱。

但是我似乎无法在查询中找到调整方法。要说仅在一天的第一天（当前一个不是启动虚拟机）或前一个日志是“解除分配虚拟机”时才获取启动虚拟机，因为这不是按顺序进行的。一天中的时间必须在公式中。 仅当先前的虚拟机是启动虚拟机时，才获取解除分配的虚拟机。 并计算并非每天的每次运行时间。

由于我是SQL和kusto的新手，所以我不希望有人来为我提供解决方案或为我工作。 我希望有人能帮助我或指导我朝正确的方向找到解决问题的方法。

先谢谢了！

Answer 1

请检查以下方法是否使您更接近所需。

datatable(Resource:string, Event:string, EventTime:datetime)
[
    'Machine1', 'Start', datetime(2019-04-12 00:00),
    'Machine1', 'Stop', datetime(2019-04-12 01:00),
    'Machine1', 'Start', datetime(2019-04-12 01:30),
    'Machine1', 'Start', datetime(2019-04-12 01:45),
    'Machine1', 'Stop', datetime(2019-04-12 11:45),
    // Machine2
    'Machine2', 'Start', datetime(2019-04-12 00:00),
    'Machine2', 'Stop', datetime(2019-04-12 01:00),
    'Machine2', 'Stop', datetime(2019-04-12 01:20),
    'Machine2', 'Start', datetime(2019-04-12 01:30),
    'Machine2', 'Stop', datetime(2019-04-12 11:45),
]
| order by Resource asc, EventTime asc
| extend IsSameResource = (prev(Resource) == Resource)
| extend PrevState = iif(IsSameResource, prev(Event), Event), CurrentState = Event
| extend RunTime = iif(PrevState == 'Start' and CurrentState == 'Stop', EventTime - prev(EventTime), time(null)), 
         StartTime = prev(EventTime)
| where isnotnull(RunTime)
| project Resource, StartTime, EndTime = EventTime, RunTime

[编辑]

相同的方法-但使用问题中提供的列：

let AzureActivity = datatable(ResourceProvider:string, Resource:string, ActivityStatus:string, OperationName:string, EventSubmissionTimestamp:datetime)
[
"Microsoft.Compute", 'Machine1', "Succeeded", 'Start Virtual Machine', datetime(2019-04-12 00:00),
"Microsoft.Compute", 'Machine1',  "Succeeded", 'Deallocate Virtual Machine', datetime(2019-04-12 01:00),
"Microsoft.Compute", 'Machine1',  "Succeeded", 'Start Virtual Machine', datetime(2019-04-12 01:30),
"Microsoft.Compute", 'Machine1',  "Succeeded", 'Start Virtual Machine', datetime(2019-04-12 01:45),
"Microsoft.Compute", 'Machine1',  "Succeeded", 'Deallocate Virtual Machine', datetime(2019-04-12 11:45),
    // Machine2
"Microsoft.Compute", 'Machine2',  "Succeeded", 'Start Virtual Machine', datetime(2019-04-12 00:00),
"Microsoft.Compute", 'Machine2',  "Succeeded", 'Deallocate Virtual Machine', datetime(2019-04-12 01:00),
"Microsoft.Compute", 'Machine2',  "Succeeded", 'Deallocate Virtual Machine', datetime(2019-04-12 01:20),
"Microsoft.Compute", 'Machine2',  "Succeeded", 'Start Virtual Machine', datetime(2019-04-12 01:30),
"Microsoft.Compute", 'Machine2',  "Succeeded", 'Deallocate Virtual Machine', datetime(2019-04-12 11:45),
];
AzureActivity
| where ResourceProvider == "Microsoft.Compute"
| where OperationName in ('Deallocate Virtual Machine','Start Virtual Machine')
| where ActivityStatus == 'Succeeded'
| order by Resource asc, EventSubmissionTimestamp asc
| extend IsSameResource = (prev(Resource) == Resource)
| extend PrevState = iif(IsSameResource, prev(OperationName), OperationName), CurrentState = OperationName
| extend RunTime = iif(PrevState == 'Start Virtual Machine' and CurrentState == 'Deallocate Virtual Machine', EventSubmissionTimestamp - prev(EventSubmissionTimestamp), time(null)), 
         StartTime = prev(EventSubmissionTimestamp)
| where isnotnull(RunTime)
| project Resource, StartTime, EndTime = EventSubmissionTimestamp, RunTime