Azure Analytics Kusto查询：如何按2个条件进行分组？

Question

我正在将Azure分析用于移动应用程序。我在主应用页面上有自定义事件-可以在 customEvents 表中找到。

我对kusto非常陌生，因此使用示例我发现了以下查询：

let start = startofday(ago(28d));
let events = union customEvents, pageViews
| where timestamp >= start
| where name in ('*') or '*' in ('*') or ('%' in ('*') and itemType == 'pageView') or ('#' in ('*') 
and itemType == 'customEvent')
| extend Dim1 = tostring(name);
let overall = events |  summarize Users = dcount(user_Id);
let allUsers = toscalar(overall);
events
| summarize Users = dcount(user_Id), Sessions = dcount(session_Id), Instances = count() by Dim1
| extend DisplayDim = strcat(' ', Dim1)
| order by Users desc
| project Dim1, DisplayDim, Users, Sessions, Instances
| project ['Activities'] = DisplayDim, Values = Dim1, ['Active Users'] = Users, ['Unique Sessions'] = Sessions, ['Total Instances'] = Instances

查询工作正常，但我希望将所有页面事件按 client_CountryOrRegion

分组

我可以通过client_CountryOrRegion进行拆分吗？

Answer 1

不确定这是否是您要查找的内容，但是如果要将结果除以client_CountryOrRegion，则可以按该列以及以下内容进行汇总：

let start = startofday(ago(28d));
let events = union customEvents, pageViews
| where timestamp >= start
| where name in ('*') or '*' in ('*') or ('%' in ('*') and itemType == 'pageView') or ('#' in ('*') 
and itemType == 'customEvent')
| extend Dim1 = tostring(name);
let overall = events |  summarize Users = dcount(user_Id);
let allUsers = toscalar(overall);
events
| summarize Users = dcount(user_Id), Sessions = dcount(session_Id), Instances = count() by Dim1, client_CountryOrRegion
| extend DisplayDim = strcat(' ', Dim1)
| order by Users desc
| project Dim1, DisplayDim, Users, Sessions, Instances
| project ['Activities'] = DisplayDim, Values = Dim1, ['Active Users'] = Users, ['Unique Sessions'] = Sessions, ['Total Instances'] = Instances, client_CountryOrRegion

更改在这里：

  

汇总用户= dcount（用户ID），会话= dcount（会话ID），实例= Dim1 ，client_CountryOrRegion