Kqlmagic返回无效的xcolumn

Question

下面的示例查询在Azure Data Explorer UI中工作，但在Jupyter Notebook中不能使用Kqlmagic。

%%kql
let min_t = toscalar(demo_make_series1 | summarize min(TimeStamp));
let max_t = toscalar(demo_make_series1 | summarize max(TimeStamp));
demo_make_series1
| make-series num=count() default=0 on TimeStamp in range(min_t, max_t, 1h) by OsVer
| render timechart

它只抛出No valid xcolumn。知道有什么问题吗?

注意:数据库demo_make_series1在ADX的帮助集群中可用。

Answer 1

这看起来确实像是KqlMagic渲染中的一个bug。我们将检查并更新。同时，您可以在渲染之前使用mv-expand。无论如何，在make-series中，我建议您避免使用已弃用的range(…)语法，而使用'from………一步…"。下面是更新后的查询:

%%kql
let min_t = toscalar(demo_make_series1 | summarize min(TimeStamp));
let max_t = toscalar(demo_make_series1 | summarize max(TimeStamp));
demo_make_series1
| make-series num=count() default=0 on TimeStamp from min_t to max_t step 1h by OsVer
| mv-expand num to typeof(long), TimeStamp to typeof(datetime)
| render timechart

谢谢,Adi