Azure Kusto-获取时间戳的平均值

我有WVD的日志。我想得到一天内连接的平均持续时间。到目前为止我得到了这个密码

datatable(Timestamp:datetime, User:string, State:string)
[ 
    datetime(10/23/2019, 7:02:02.527 AM), 'user1', 'Started', , 
    datetime(10/23/2019, 7:02:09.244 AM), 'user1', 'Connected', 
    datetime(10/23/2019, 7:14:21.156 AM), 'user1', 'Completed', 
    datetime(10/23/2019, 7:29:27.195 AM), 'user1', 'Started', 
    datetime(10/23/2019, 7:29:30.544 AM), 'user1', 'Connected', 
    datetime(10/23/2019, 7:45:35.438 AM), 'user1', 'Completed', 
]
| where State == "Started" or State == "Completed"
| where datetime_part("dayOfYear",TimeGenerated) == datetime_part("dayOfYear",todatetime('2020-06-25 01:02:03.7654321'))
| summarize arg_max(TimeGenerated, *) by State, UserName
| order by UserName asc, TimeGenerated asc 
| extend duration = iff(UserName == prev(UserName), TimeGenerated - prev(TimeGenerated), 0s)
| summarize avg(duration) by UserName, State
| where State == "Completed"

我想得到每个用户和每个连接的所有完成-启动时间之间的平均时间

---

谢谢

您可以尝试以下方法：

datatable(Timestamp:datetime, User:string, State:string)
[ 
    datetime(10/23/2019, 7:02:02.527 AM), 'user1', 'Started', 
    datetime(10/23/2019, 7:02:09.244 AM), 'user1', 'Connected', 
    datetime(10/23/2019, 7:14:21.156 AM), 'user1', 'Completed', 
    datetime(10/23/2019, 7:29:27.195 AM), 'user1', 'Started', 
    datetime(10/23/2019, 7:29:30.544 AM), 'user1', 'Connected', 
    datetime(10/23/2019, 7:45:35.438 AM), 'user1', 'Completed', 
]
| where State == "Started" or State == "Completed"
| where startofday(Timestamp) == datetime(2019-10-23)
| order by User asc, Timestamp asc 
| extend duration = iff(User == prev(User) and State == 'Completed' and prev(State) == "Started", Timestamp - prev(Timestamp), timespan(null))
| where isnotnull(duration)
| summarize avg(duration) by User // you can remove the 'by User' if you don't need it. it wasn't completely clear from your question

---

如果您解释如何定义

连接的开始和结束

，并提供一个示例数据集（使用

数据表

运算符），帮助演示您试图解决的问题，即包括输入、预期匹配输出、，并简要说明将输入转换为输出的逻辑添加它！谢谢你的观察！谢谢！工作得很好。一些更改以适应原始表格。：）过滤器上的小更改：|其中持续时间！="00:00:00"