Kusto-每个系列的时间戳最后一行

Question

我有一个表，其中记录了消息，对于每个操作，都有几条带有时间戳的消息。 我需要获取每个operation_id的最后一条消息。

示例数据：

timestamp                  | operation_id | message 
---------------------------|--------------------------------------------------------
10/2/2019, 10:00:10.000 AM |    1         | message (last msg for this operation id)
10/2/2019, 10:00:00.000 AM |    1         | message
10/2/2019, 10:00:03.000 AM |    2         | message (last msg for this operation id)
10/2/2019, 10:00:00.000 AM |    3         | message
10/2/2019, 10:00:00.000 AM |    2         | message
10/2/2019, 10:00:15.000 AM |    3         | message (last msg for this operation id)

所需的输出：

timestamp                  | operation_id | message 
---------------------------|--------------------------------------------------------
10/2/2019, 10:00:10.000 AM |    1         | message (last msg for this operation id)
10/2/2019, 10:00:03.000 AM |    2         | message (last msg for this operation id)
10/2/2019, 10:00:15.000 AM |    3         | message (last msg for this operation id)

Answer 1

看看聚合函数arg_max()

请注意，适用的示例在arg_min（）文档中...