使用kusto查询计算两次操作的时间差

Question

我想使用kusto查询计算操作名称包含ID的两个操作之间的时间差。请找到附件的快照，其中包含表格和所需的输出。如果有人能分享Kusto查询来实现同样的目标，那将是很有帮助的。

timestamp [IST]                 name
2022/30/6, 4:10:00.460 AM   fbf759a0-d4be-4d07-adfb-7090a207e667  Success: Reached Three
2022/30/6, 4:12:00.091 AM   fbf759a0-d4be-4d07-adfb-7090a207e667  Success: Reached Two
2022/30/6, 4:10:00.460 AM   ewerewtetete-4d07-adfb-7090a207e667 Retry message
2022/30/6, 4:14:10.791 AM   fbf759a0-d4be-4d07-adfb-7090a207e667  Success: Reached One
2022/30/6, 4:15:10.460 AM   ewerewtetete-4d07-adfb-7090a207e667  Success: Reached Three
2022/30/6, 4:20:04.343 AM   fbf759a0-d4be-4d07-adfb-7090a207e667 Retry message

输出

Time Difference by operationID(which is part of name) in seconds
fbf759a0-d4be-4d07-adfb-7090a207e667    604
ewerewtetete-4d07-adfb-7090a207e667 310

Answer 1

datatable(['timestamp [IST]']:datetime, name:string)
[
"2022-06-30 04:10:00.460" ,"fbf759a0-d4be-4d07-adfb-7090a207e667  Success: Reached Three"
,"2022-06-30 04:12:00.091" ,"fbf759a0-d4be-4d07-adfb-7090a207e667  Success: Reached Two"
,"2022-06-30 04:10:00.460" ,"ewerewtetete-4d07-adfb-7090a207e667 Retry message"
,"2022-06-30 04:14:10.791" ,"fbf759a0-d4be-4d07-adfb-7090a207e667  Success: Reached One"
,"2022-06-30 04:15:10.460" ,"ewerewtetete-4d07-adfb-7090a207e667  Success: Reached Three"
,"2022-06-30 04:20:04.343" ,"fbf759a0-d4be-4d07-adfb-7090a207e667 Retry message"
]  
|   project-rename ts = ['timestamp [IST]']
|   parse name with OperationID " " *
|   summarize TimeDiffSec = round((max(ts) - min(ts)) / 1s) by OperationID

tbody> <<tr>

OperationID	TimeDiffSec
fbf759a0 d4be - 4 - d07 adfb - 7090 a207e667	604
ewerewtetete - 4 - d07 adfb - 7090 a207e667	310