KQL按计数汇总，然后过滤

Question

查询的目的是查看在任何给定的分钟内我们是否有超过500条日志。

我在| summarize count() by bin(env_time, 1m)末尾有这行，但是现在我想知道我是否可以添加过滤，以便只看到超过500个结果的行。类似以下语句:

| totals = summarize count() by bin(env_time, 1m)
| where totals>500

是否有办法在KQL中正确地做到这一点?

TIA

Answer 1

let t = materialize(range i from 1 to 9700 step 1 | extend env_time = ago(20m * rand()));
t
| summarize count() by bin(env_time, 1m)
| where count_ > 500

<表类>env_timecount_tbody><<tr>2023 - 01 - 08 - t09:54:00z5312023 - 01 - 08 - t09:56:00z5012023 - 01 - 08 - t09:57:00z5012023 - 01 - 08 - t10:00:00z5102023 - 01 - 08 - t10:03:00z502