当前,我有一个查询,该查询返回Union
3个表(总共13行)。所有3个表都有相同的列集。
let bytes_to_gb =
(1024 * 1024 * 1024)
;
let tab_cpu =
performanceCounters
| where category == "Processor" and counter == "% Processor Time" and instance == "_Total"
| where ...
| summarize timestamp = max(timestamp), value = avg(value) by host_name = cloud_RoleInstance, host_type = "WXYZ", counter_name = "%CPU", threshold = 90
;
let tab_memory =
performanceCounters
| where category == "Memory" and counter == "Available Bytes"
| where ...
| summarize timestamp = max(timestamp), value = avg(value / bytes_to_gb) by host_name = cloud_RoleInstance, host_type = "ZYXW", counter_name = "Available Memory (GB)", threshold = 10
;
let tab_exceptions =
exceptions
| where ...
| summarize timestamp = max(timestamp), value = (count(itemCount) * 1.0) by host_name = "Exceptions", host_type = "Web", counter_name = "Exception", threshold = 10
| where value >= 10
union
tab_cpu, // 6 rows
tab_memory, // 6 rows
tab_exceptions // 1 row
我正在寻找的是-包括结果tab_cpu
和tab_memory
ONLY,如果tab_exceptions
有行。
这就是我在SQL查询中要做的,但是没有为KQL获得适当的解决方案。
IF EXISTS (SELECT * FROM tab_exceptions WHERE ...)
SELECT * FROM tab_cpu WHERE ...;
UNION
SELECT * FROM tab_memory WHERE ...
UNION
SELECT * FROM tab_exceptions WHERE ...
ELSE
...
您可以通过union
类似于以下示例的方式使用运算符:
let T1 = range x from 1 to 3 step 1; // for the other case, replace with: let T1 = datatable(x:long)[];
let T2 = range x from 4 to 6 step 1;
let T3 = range x from 7 to 9 step 1;
let T1_has_rows = toscalar(T1 | summarize count() > 0);
union
(T1 | where T1_has_rows == false),
(union T1, T2, T3 | where T1_has_rows == true)
本文收集自互联网,转载请注明来源。
如有侵权,请联系[email protected] 删除。
我来说两句