azure-application-insights - Application Insights Analytics执行子选择

我将此参考documentation用于Application Insights。

如何使用其他查询的输出进行子选择？

//Query 1
Events
| where  Timestamp >= ago(30min) and Data contains('SomeString')
| project TraceToken

//I would like to use the first query's output in the subselect here.
Events
| where TraceToken in ({I would like to use the First query's output here.})

在这种情况下联接更好。哪个会有更好的表现。

最佳答案

您可以使用let语句来实现。

这是Analytics documentation的示例，希望对您有所帮助:

let topCities =  toscalar ( // convert single column to value
   requests
   | summarize count() by client_City
   | top 4 by count_
   | summarize makeset(client_City));
requests
| where client_City in (topCities)
| summarize count() by client_City;

编辑:默认情况下，makeset()函数返回的最大元素数为128。应该为较大的dataSet指定MaxSetSize。

关于azure-application-insights - Application Insights Analytics执行子选择，我们在Stack Overflow上找到一个类似的问题：https://stackoverflow.com/questions/42258994/