在另一个表的bin运算符中使用一个表中的值

Question

考虑以下查询：

这将为bin_duration的固定值生成1个单元格结果：

events
| summarize count() by id, bin(time , bin_duration) | count

我希望生成一个具有bin_duration变量值的表。

bin_duration将采用下表中的值：

range bin_duration from 0 to 600 step 10;

这样决赛桌看起来像这样：

如何实现这一目标？

谢谢

Answer 1

bin(value,roundTo)又称floor(value,roundTo)，会将value舍入到roundTo的最接近倍数，因此您不需要外部表。

events 
| summarize n = count() by bin(duration,10) 
| where duration between(0 .. 600) 
| order by duration asc

您可以在Stormevents教程中进行尝试：

let events = StormEvents | extend duration = (EndTime - StartTime) / 1h;
events 
| summarize n = count() by bin(duration,10) 
| where duration between(0 .. 600) 
| order by duration asc 

在处理时间序列数据时，bin()也了解方便的timespan literals，例如：

let events = StormEvents | extend duration = (EndTime - StartTime);
events 
| summarize n = count() by bin(duration,10h) 
| where duration between(0h .. 600h) 
| order by duration asc