应用洞察分析让算子

Question

下面的查询有什么问题？

let errIds = exceptions
| where operation_Name == "My Special Operation" 
| summarize by operation_Id
traces
| where operation_Name == "My Special Operation" and operation_Id !in (errIds)
| summarize count() by operation_Id 

我想要的是不产生异常的操作.

Answer 1

实际上，我所缺少的只是let语句之后的一个let

Answer 2

要获得不生成异常的跟踪，不如使用join使用exceptions，如下所示。将该类型的join设置为anti，以便获取没有任何关联异常的所有跟踪。

traces
    | where operation_Name == "My Special Operation"
    | join kind=anti (exceptions) on operation_Id
    | summarize count() by operation_Id