Kusto语言枢轴2栏

Question

我用古斯托语查询以下内容：

    AzureActivity
| where ResourceProvider == "Microsoft.Compute"
| where OperationName in ('Deallocate Virtual Machine','Start Virtual Machine')
| where ActivityStatus == 'Succeeded'
| order by Resource asc, EventSubmissionTimestamp asc
| extend IsSameResource = (prev(Resource) == Resource)
| extend PrevState = iif(IsSameResource, prev(OperationName), OperationName), CurrentState = OperationName
| extend RunTime = iif(PrevState == 'Start Virtual Machine' and CurrentState == 'Deallocate Virtual Machine', EventSubmissionTimestamp - prev(EventSubmissionTimestamp), time(null)), StartTime = prev(EventSubmissionTimestamp)
| where isnotnull(RunTime)
| project Resource, StartDate= format_datetime(todatetime(StartTime), 'MM/yyyy'),  StopDate=format_datetime(todatetime(EventSubmissionTimestamp), 'MM/yyyy'),
RuntimeThisMonth= iif( format_datetime(todatetime(StartTime), 'MM/yyyy') != format_datetime(todatetime(EventSubmissionTimestamp), 'MM/yyyy') , (datetime_diff('minute',todatetime(EventSubmissionTimestamp) ,startofmonth(EventSubmissionTimestamp)) / 60) ,(datetime_diff('minute',todatetime(EventSubmissionTimestamp) ,todatetime(StartTime)) / 60)) ,
  RuntimeLastMonth=iif( format_datetime(todatetime(StartTime), 'MM/yyyy') != format_datetime(todatetime(EventSubmissionTimestamp), 'MM/yyyy') , (datetime_diff('minute',startofmonth(EventSubmissionTimestamp) ,todatetime(StartTime)) / 60) ,0) 

哪个给了我以下结果。

现在，我想对获取此类表格的日期进行调整。

在上一个项目中，我使用了评估枢轴命令来对列进行枢轴运算并对运行时求和，但是现在我必须对列（上个月和本月）进行操作，而我找不到找到对这两个列进行枢轴旋转的方法。

| evaluate pivot(StartDate, sum(RuntimeLastMonth) , StopDate , sum(RuntimeThisMonth))

有人知道我的数据透视查询中缺少什么吗？

Answer 1

这也许可行：

datatable(Resource:string, StartDate:datetime, StopDate:datetime, RuntimeThisMonth:long, RuntimeLastMonth:long)
[
    "A", datetime(2019-05-01), datetime(2019-05-01), 33, 0,
    "C", datetime(2019-05-01), datetime(2019-05-01), 0,  0,
    "A", datetime(2019-05-01), datetime(2019-05-01), 9,  0,
    "C", datetime(2019-04-01), datetime(2019-05-01), 69, 48,
    "D", datetime(2019-04-01), datetime(2019-05-01), 69, 48,
]
| where RuntimeLastMonth > 0 or RuntimeThisMonth > 0
| summarize RuntimeLastMonth = sum(RuntimeLastMonth), RuntimeThisMonth = sum(RuntimeThisMonth) by StartDate, StopDate, Resource
| project Resource, p = pack(
    format_datetime(StopDate, "MM/yyyy"), RuntimeThisMonth, 
    format_datetime(StartDate, "MM/yyyy"), RuntimeLastMonth)
| evaluate bag_unpack(p)

➡

| Resource | 05/2019 | 04/2019 |
|----------|---------|---------|
| A        | 42      |         |
| C        | 69      | 48      |
| D        | 69      | 48      |