Kusto：查询以分组http状态代码

问题描述

我正在尝试从Azure Log Analytics查询一些与Azure Application Gateway相关的事情。

对于每一个http状态代码，我都会得到这样的查询：

AzureDiagnostics
| where ResourceProvider == "MICROSOFT.NETWORK" and Category == "ApplicationGatewayAccessLog"
| summarize count() by httpStatus_d,Resource

现在我需要将这些结果分组为2xx，3xx，4xx和5xx。

对Kusto来说是新手，我找不到实现此目标的正确方法。 感谢您的提示！

解决方法

您可以尝试使用bin()函数，例如：

AzureDiagnostics
| where ResourceProvider == "MICROSOFT.NETWORK" and Category == "ApplicationGatewayAccessLog"
| summarize count() by bin(httpStatus_d,100),Resource

,

感谢@yoni，他将我送往了正确的方向。

我这样解决了：

AzureDiagnostics
| where ResourceProvider == "MICROSOFT.NETWORK" and Category == "ApplicationGatewayAccessLog"
| extend HTTPStatus = case(httpStatus_d between (200 .. 299),"2XX",httpStatus_d between (300 .. 399),"3XX",httpStatus_d between (400 .. 499),"4XX","5XX")
| summarize count() by HTTPStatus,bin(timeStamp_t,1h)
| render timechart