我正试图在日志分析工作区中构建一个图,以了解一周中哪一天的登录次数最多。
我有这个问题
SigninLogs
| where ResultType == 0
| summarize SuccessfulSigns=count() by bin(TimeGenerated,1d)
但我想做一个条形图,你可以看到在90天的查询中,周日、周一等有多少登录。
您可以将dayofweek
与format_timespan一起使用,类似于
let Days = datatable(day_number:int, day:string)
[
1, "Monday",
2, "Tuesday",
3, "Wednesday",
4, "Thursday",
5, "Friday",
6, "Saturday",
7, "Sunday",
];
SigninLogs
| where ResultType == 0
| summarize SuccessfulSigns=count() by day_number=toint(format_timespan(dayofweek(bin(TimeGenerated,1d)), "d"))
| join Days on day_number
| project SuccessfulSigns, day
它将日期返回为整数1=星期一,2=星期二,3=星期三,并将其映射到数据表day_number。
day SuccessfulSigns
Wednesday 135