1

因此，假设我想测试一个在过去数据中发现异常值的函数。我很想得到一个看起来像这样的表：

Time                    Outliers_At_Time
<somedate>              0
<somedate + interval>   1

该函数如下所示：

let OutliersAt = (TheDate:datetime) {
<… outputs zero or a positive integer>
}

我的直觉是做这样的事情：

let SomeDates = range AtTime from ago(10d) to now() step 10m;
SomeDates | extend NumOutliers = OutliersAt (AtTime)

…但这给了我这个错误信息：

错误语义错误：“”具有以下语义错误：未解析的引用绑定：“AtTime”。clientRequestId: KustoWebV2;1ea28ba0-12f1-4a52-95e7-975db3310f59

建议？

4

1 回答 1

2

如果您正在寻找异常值 - Kusto 中有一个内置函数可以执行此操作： https ://docs.microsoft.com/en-us/azure/kusto/query/series-outliersfunction

例子：

let _data =
range Timestamp from ago(7d) to now() step 1min
    | extend Value=case(rand(1000)==10, 1200.0, rand(100));
// 
_data 
| make-series AvgValue=avg(Value) default=0 on Timestamp in range(ago(7d), now(), 5min) 
| extend outliers=series_outliers(AvgValue)
| render timechart

If the question is about general way to provide parameters to user-defined functions, see more info here: https://docs.microsoft.com/en-us/azure/kusto/query/functions/user-defined-functions

In particular, you can pass a serie into a user-defined-function (e.g. to get statistics):

let OutliersAt = (_serie:dynamic) {
   let stats = series_stats_dynamic(_serie);
   todouble(stats.max_idx) >= 0 
};
let _data =
    range Timestamp from ago(7d) to now() step 1min
    | extend Value=case(rand(1000)==10, 1200.0, rand(100));
//
_data 
| make-series AvgValue=avg(Value) default=0 on Timestamp in range(ago(7d), now(), 5min) 
| extend outliers=series_outliers(AvgValue)
| project hasOutliers=OutliersAt(outliers)
于 2018-11-16T16:21:39.197 回答