查询返回数据尺寸大于truncationmaxsize限制

Question

我有一个应用程序Insights kusto查询，其中返回的数据大小大于我的truncationmaxsize限制。有这样的原因吗？我试图将返回的数据限制为小于8MB。我添加了
|总结总计= sum（estimate_data_size（*））

在我的查询结束时，它显示了我返回的10.7mb。为什么会发生这种情况？如何解决此问题？ TruncationMaxRecords似乎有效，但是TruncationMaxsize对我不起作用。

原始查询：

set truncationmaxsize=8000000; union (traces | extend details = dynamic(null)), (exceptions | project timestamp, operation_Id, name = iff(isnotempty(innermostType), innermostType, outerType), message = iff(isnotempty(innermostMessage), innermostMessage, outerMessage), details) | where timestamp >= datetime(2022-07-06T22:28:43.539650600) | as main | project operation_Id, operation_Name, Timestamp = timestamp, SeverityLevel = severityLevel, Name = name, Message = message | where Message contains 'Job failed. Error:' | summarize arg_max(Timestamp, *) by operation_Id | join kind=leftouter (main | project operation_Id, except_timestamp=timestamp, except_severityLevel = severityLevel, except_Message = message | where (isempty(except_severityLevel) and except_Message !contains "retry") | summarize arg_max(except_timestamp, *) by operation_Id) on operation_Id | join kind=leftouter (main | project operation_Id, dt_message = message, dt_timestamp = timestamp | where dt_message contains 'Type Data' or dt_message contains 'Type: Data' or dt_message contains 'Execute data' | summarize arg_max(dt_timestamp, *) by operation_Id | extend data_type = extract(@"(?:Type|Type:|Execute)\s*((?i)data\s*\w+)", 1, dt_message) | project operation_Id, dt_timestamp, dt_message, failed_on = data_type) on operation_Id | join kind=leftouter (main | project operation_Id, activity_number_message = message, anm_timestamp = timestamp | where activity_number_message contains 'Processing activity' | summarize arg_max(anm_timestamp, *) by operation_Id | project operation_Id, anm_timestamp, activity_number_message) on operation_Id | top 1000 by Timestamp asc | summarize Total=sum(estimate_data_size(*)) 

Answer 1

我刚刚意识到DruncationMaxSize有效。 10.7MB本身的结果不需要10.7MB的数据显示。忽略这个问题，这是解决的。