如何将来自不同查询的值（计数）组合成一个查询

Posted 2023-02-19

【中文标题】如何将来自不同查询的值（计数）组合成一个查询

【英文标题】：How to combine values (count) from different queries into a single query

【发布时间】：2021-10-08 05:14:44

【问题描述】：

在 KQL 中有什么方法可以将来自不同查询的值（计数）组合成一个查询。

目前我做的方式是有两个查询，得到计数。粘贴第三个查询中的值并找到百分比（请参阅下文）。

// First query
let football_played = database("database1").games_played
| where game_type contains "football"
| where Time > ago(1m);
football_played| count

// Second query
let registered_for_football = database("db2").registerd_players
| where EventInfo_Time > ago(1m)
| where registered_game contains "football"
registered_for_football | count

// Third query
let football_count = 13741;
let registered_count = 701588;
print cnt1 = football_count , cnt2 = registered_count 
| extend percentage = (todouble(cnt1) * 100 / todouble(cnt2))
| project percentage, cnt2, cnt1

在 Kql 中有什么方法可以在一个查询中计算所有内容并打印百分比吗？

提前致谢

【参考方案1】：

你可以试试这个：

let football_played = toscalar(
    database("database1").games_played
    | where Time > ago(1m)
    | where game_type contains "football"
    | count
);
let registered_for_football = toscalar(
    database("db2").registered_players
    | where EventInfo_Time > ago(1m)
    | where registered_game contains "football"
    | count
);
print football_played, registered_for_football 
| extend percentage = round(100.0 * football_played / registered_for_football, 2)

【讨论】：

就是这样。谢谢@Yoni L