San*_*air 0 kql azure-data-explorer
我有一个名为tab1:
Timestamp Username. sessionid
12-12-2020. Ravi. abc123
12-12-2020. Hari. oipio878
12-12-2020. Ravi. ytut987
11-12-2020. Ram. def123
10-12-2020. Ravi. jhgj54
10-12-2020. Shiv. qwee090
10-12-2020. bob. rtet4535
30-12-2020. sita. jgjye56
Run Code Online (Sandbox Code Playgroud)
我想计算每天不同 s 的数量Username,以便输出为:
day. count
10-12-2020. 3
11-12-2020. 1
12-12-2020. 2
30-12-2020. 1
Run Code Online (Sandbox Code Playgroud)
尝试查询:
tab1
| where timestamp > datetime(01-08-2020)
| range timestamp from datetime(01-08-2020) to now() step 1d
| extend day = dayofmonth(timestamp)
| distinct Username
| count
| project day, count
Run Code Online (Sandbox Code Playgroud)
要非常接近地估计每天的用户名数量,只需运行此命令(该数字不准确,请参阅此处的详细信息):
tab1
| summarize dcount(Username) by bin(Timestamp, 1d)
Run Code Online (Sandbox Code Playgroud)
如果您想要准确的结果,那么您应该这样做(请注意,该查询的性能将低于前一个查询,并且仅当您每天最多有 1,000,000 个用户名时才有效):
tab1
| summarize make_set(Username) by bin(Timestamp, 1d)
| project Timestamp, Count = array_length(set_Username)
Run Code Online (Sandbox Code Playgroud)
| 归档时间: |
|
| 查看次数: |
5221 次 |
| 最近记录: |