日志分析查询-组字符串/对象

Question

我有一个查询，它显示了过去5分钟内5xx和4xx错误的结果：

    requests
| where timestamp > now() - 5m
| where url contains "xxxxxx" and resultCode startswith "5" or resultCode startswith "4"
| project resultCode
| summarize Count= count() by resultCode

查询打印所有5xx和4xx，如下所示：

​

​

是否可以获得所有4xx和5xx的计数，但打印在2行？？示例：

​

​

谢谢

Answer 1

像这样的东西应该能起到作用

run in web

datatable(resultCode: string, count: long) [ 
    400, 97,
    401, 764,
    403, 6118,
    404, 7083,
    406, 11,
    500, 131
]
| extend resultKind= strcat(substring(resultCode, 0, 1), "xx")
| summarize sum(['count']) by resultKind