I have two tables in Azure Data Explorer (KQL): AzureMetric and AegDataplaneRequest. These tables are part of the same process but contain very different data, and there is no field that can be used to join them.
In SQL, I would have stored the latest timestamp of each table in a variable, then calculated the difference between them. However, in KQL, we must use a different approach due to the lack of support for variables like in SQL.
I want to calculate the time difference between the latest entry (most recent timestamp) of each table. How can I achieve this in KQL without being able to join the tables directly?
You could do something with toscalar() values and the like, would something like this work in your use case?
let AzureMetric = datatable(timestamp:datetime, metric:string) [
datetime(2024-10-28 12:00:00), 'metric1',
datetime(2024-10-28 15:00:00), 'metric2'
];
let AegDataplaneRequest = datatable(timedate:datetime, request:string) [
datetime(2024-10-27 12:01:00), 'request1',
datetime(2024-10-28 13:01:00), 'request2'
];
let MostRecentAzureMetric = toscalar(AzureMetric | summarize max(timestamp));
let MostRecentAegDataplaneRequest = toscalar(AegDataplaneRequest | summarize max(timedate));
let TimeDifference = datetime_diff('minute', MostRecentAzureMetric, MostRecentAegDataplaneRequest);
print TimeDifference
print_0 |
---|
119 |