azurekqlkusto-exploreradx

I want to generate 24 hour data(by filtering the date column to 24 hours) in KUSTO by adding custom start time and endtime values


input and expected output I have date and status values in a table, i want to select the date range for a period of 24h, I want to get all the status values including starting and ending date values. But those values were not present in the table. It has to get it from previous record.

I have attached the sample data in the screenshot for better understanding.

I have tried by creating a column with prev() staus value and by doing this i am not able to get the last record and its status value.

Can you help how can i get both starting and ending custom date values.

Also for selected time period if there is no data found, it should display the previous record. Is it possible?


Solution

  • I have used some dummy data to create a table. The UDF created expects starttime and endtime parameters to achieve the desired result asked in question.

    Code/Query

    let  myFunc = (CustomStartDate : datetime ,CustomEndDate : datetime )
    {
    //Created temporary table named "tbl"    
    let  tbl = datatable(Time: datetime , Status: string )
    [
    datetime(2023-03-16 07:14:58.4785756), "Running",
    datetime(2023-03-16 11:15:49.7803968), "Stopped",
    datetime(2023-03-16 13:46:31.8371005), "Idle",
    datetime(2023-03-16 21:00:00.0000000),"Stopped",
    datetime(2023-03-16 23:00:00.0000000),"Running",
    datetime(2023-03-17 05:16:51.9252773), "Stopped",
    datetime(2023-03-17 13:16:51.9252773), "Running"
    ];
    //selecting records which falls between start date and end date and creating new temporary table named "tbl1"
    let  tbl1 = tbl | where  Time  between ( CustomStartDate .. CustomEndDate);
    //creating 2 variables to store minimum and maximum time values within the custom time provided to get the previous and current status
    let  minDate = tbl1 | summarize  min(Time);
    let  maxDate = tbl1 | summarize  max(Time);
    let  PreStatus = tbl | where  Time < toscalar(minDate)| order  by  Time  desc | project  Status | take 1;
    let  CustomEndStatus = tbl1 | where  Time == toscalar(maxDate) |project  Status ;
    //Union custom dates and status with tbl1 and sorted the table on basis of Time ascending order.
    tbl1
    | union (print  Time = CustomStartDate, Status = toscalar(PreStatus))
    | union (print  Time = CustomEndDate, Status = toscalar(CustomEndStatus ))
    | order  by  Time  asc
    };
    myFunc(datetime(2023-03-16 20:00:00.0000000),datetime(2023-03-17 12:00:00.0000000))
    

    Result enter image description here