在日志分析中添加一排，kusto查询

发布于 2025-02-05 13:25:47 字数 672 浏览 2 评论 0原文

我查询请求日志以摘要状态代码。但是，我想在结果结束时添加一行，以显示请求总数。如何添加这样的行？

当前查询（简化）

MyLog
| summarize count() by responseCode

当前结果看起来像是

响应量	计数
200	1000
404	20
500	100

我想拥有这样的总数，例如This

Responsecode	Count
200	1000
404	20
500	100
总计	1120

原文

I query a request log for a summary of status codes. However I would like to add a row at the end of the results, showing the total number of requests. How do I add such a row?

Current query (simplified)

MyLog
| summarize count() by responseCode

Current result looks like

responseCode	count
200	1000
404	20
500	100

I would like to have the totals like this

responseCode	count
200	1000
404	20
500	100
total	1120

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

聽兲甴掵 2025-02-12 13:25:49

您可以尝试以下操作：

MyLog
| summarize c = count() by responseCode
| as hint.materialized=true T
| union (T | summarize c = sum(c) by responseCode = "total")

或以下：

MyLog
| summarize c = count() by responseCode
| union (print responseCode = "total", c = toscalar(MyLog | count))

如果您想将“总”行持续保留，则可以订购联合数据集。例如：

MyLog
| summarize c = count() by responseCode
| extend _o = 0
| union (
    print responseCode = "total",
          c = toscalar(MyLog | count),
          _o = 1
)
| order by _o asc, c desc
| project-away _o

you could try this:

MyLog
| summarize c = count() by responseCode
| as hint.materialized=true T
| union (T | summarize c = sum(c) by responseCode = "total")

or this:

MyLog
| summarize c = count() by responseCode
| union (print responseCode = "total", c = toscalar(MyLog | count))

if you want to keep the 'total' row last, you can order the unioned data set. for example:

MyLog
| summarize c = count() by responseCode
| extend _o = 0
| union (
    print responseCode = "total",
          c = toscalar(MyLog | count),
          _o = 1
)
| order by _o asc, c desc
| project-away _o

回复收藏 0 原文

~没有更多了~