KQL帮助:需要修剪Datetime值

Question

我需要在KQL中修剪Datetime值。

我有基于Azure的定时器触发功能，每30分钟运行一次

("0 */30 * * * *")]

我有2个日期时间列StartTime和EndTime。我通过总结min(StartTime)获得Azure函数的运行时间——max (EndTime)．我想要min(StartTime)调整到Azure函数的实际开始时间

:如果min(StartTime) Column Value为"2021-10-25 10:02:26.7630995";那么StartTime应该是"2021-10-25 10:00:00.000000">

和

min(StartTime)列值为"2021-10-25 10:32:26.7630995";那么StartTime应该是"2021-10-25 10:30:00.000000">

My Code so far:(我在第4行需要帮助)

MyKustoTable | where isnotempty(RunID) and RunID > 41
| project RunID, CollectionTime, IngestionTime = ingestion_time()-30m
| summarize StartTime = min(CollectionTime), EndTime = max(IngestionTime) by RunID
| extend RBACDurationInMins = case((EndTime - StartTime)/1m > 30, "Trimmed StartTime", StartTime) 
| extend RBACDurationInMins = (EndTime - StartTime)/1m, ResourceType = "RBAC"
| project ResourceType, RunID, StartTime, EndTime, RBACDurationInMins
| sort by RunID desc

Answer 1

您可以使用bin()函数:https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/binfunction

如果min(StartTime)列值为" 20121-10-25 10:02:26.7630995"那么StartTime应该是"2021-10-25 10:00:00.000000">

如果min(StartTime) Column Value为" 20121-10-25 10:32:26.7630995"那么StartTime应该是"2021-10-25 10:30:00.000000">

print dt1 = datetime(2021-10-25 10:02:26.7630995), 
dt2 = datetime(2021-10-25 10:32:26.7630995)
| project result1 = bin(dt1, 30m),
result2 = bin(dt2, 30m)

tbody> <<tr>

result1	result2
2021-10-25 10:00:00.0000000	2021-10-25 10:30:00.0000000