Azure 来自日志分析聚合的饼图

我正试图在Kusto中编写一个简单的聚合查询，根据心跳显示目前有多少台机器处于活动状态

我可以通过以下查询获取活动状态：

Heartbeat 
| summarize LastHeartbeat=max(TimeGenerated) by Computer

这将产生类似于以下内容的输出：

计算机 最后心跳频率[UTC]

VM1 5/4/2020，下午3:23:40.227
VM2 5/4/2020，下午2:59:46.780

但我想添加一个列，它不是由计算机生成的，而是总计生成的max（TimeGenerated）。我试图通过多个术语进行聚合，但显然这是不可能的：

Heartbeat 
| summarize LastHeartbeat=max(TimeGenerated) by Computer, Latest=max(TimeGenerated)
| extend isAlive = (LastHeartbeat == Latest)

---

我的问题是-我如何使用这些数据来呈现一个饼图，显示活的/死的机器？如何使用这些数据来呈现一个显示机器关闭/打开比率的图表？

您可以尝试以下方法：

datatable(vm_id:string, dt:datetime)
[   
    'VM1', datetime(5/3/2020, 3:23:40.227 PM),
    'VM2', datetime(5/4/2020, 2:59:46.780 PM),
    'VM3', datetime(5/4/2020, 2:59:46.780 PM),
]
| as T // this is your summary table, where each vm_id has a single entry with its max datetime
| extend status = case(dt == toscalar(T | summarize max(dt)), "ON", "OFF") 
| summarize count() by status
| render piechart 

---

您可以尝试以下方法：

datatable(vm_id:string, dt:datetime)
[   
    'VM1', datetime(5/3/2020, 3:23:40.227 PM),
    'VM2', datetime(5/4/2020, 2:59:46.780 PM),
    'VM3', datetime(5/4/2020, 2:59:46.780 PM),
]
| as T // this is your summary table, where each vm_id has a single entry with its max datetime
| extend status = case(dt == toscalar(T | summarize max(dt)), "ON", "OFF") 
| summarize count() by status
| render piechart