Click here to Skip to main content
15,891,859 members

Comments by Mangesh9692 (Top 49 by date)

Mangesh9692 14-Apr-21 23:50pm View    
I have tried this but no luck. Could you please help me on this




let test=(TestTransctions
|join kind = inner
(TestTransctions)
on $left.GlobalID == $right.GlobalID
| where EventTimeStamp_t > ago(totimespan((TimeGenerated))) and type='event'
| summarize (ets1, ts1) = arg_min (EventTimeStamp_t,SpecialEventName_s), (ets2,ts2) = arg_max(EventTimeStamp_t1, SpecialEventName_s1) by GlobalID
| project ets1, ts1, ets2, ts2, ets3=ets2 - ets1,GlobalID
|project-rename JobStarted=ets1,JobStopped=ets2
|project-keep JobStarted,JobStopped,GlobalID);
let test2=(TestTransctions| where IsTransactionAdhoc_b=='false');
test2
|join kind=leftouter
(test)
on $left.GlobalID == $right.GlobalID
|where EventTimeStamp_t between (todatetime(JobStopped)..todatetime(JobStarted))
Mangesh9692 31-Mar-21 2:35am View    
Yes i have written it but it now working as SQL,Alias is not working. Not giving syntax error but output is not coming

let test=(TestTransctions
|join kind = inner
(TestTransctions)
on $left.GlobalID == $right.GlobalID
| where EventTimeStamp_t > ago(totimespan((TimeGenerated))) and type='event'
| summarize (ets1, ts1) = arg_min (EventTimeStamp_t,SpecialEventName_s), (ets2,ts2) = arg_max(EventTimeStamp_t1, SpecialEventName_s1) by GlobalID
| project ets1, ts1, ets2, ts2, ets3=ets2 - ets1,GlobalID
|project-rename JobStarted=ets1,JobStopped=ets2
|project-keep JobStarted,JobStopped,GlobalID);
let test2=(TestTransctions| where IsTransactionAdhoc_b=='false');
test2
|join kind=leftouter
(test)
on $left.GlobalID == $right.GlobalID
|where EventTimeStamp_t between (todatetime(JobStopped)..todatetime(JobStarted))
Mangesh9692 30-Mar-21 23:38pm View    
Yes this query is working fine as like my previous query but I have written KQL query for same but its not working
Mangesh9692 30-Mar-21 6:28am View    
OK let me give me my problem statement so u might be understand what I am trying to write

I have one table in Azure data explorer log analytics work space where I am logging my all transaction with their timestamp with type=transaction with different guid for each log, in the same table I am logging my background job start and stop against same guid(same guid for single cycle ie start and stop event) with their respective time stamp with type=event. Now I want find a record from this table with type=transaction those are falling in Job start and stop event timestamp .Thanks
Mangesh9692 30-Mar-21 5:04am View    
Yes I know but join is not usefull, and my concern is related to KQL(Kusto query language)