KQL 连接运算符仅返回左表列

Question

我有一个 KQL 查询，它连接两个表（table1 和 table2），但仅返回左表（table1）的列。但是，如果我单独运行这些表查询，它们都会返回各自的列和数据。

这里的问题是，表 1 和表 2 中还连接了两个表。 table1是table3和table 4的左外连接的结果集。table2是table5和table6的左外连接的结果集。

当我执行左外连接（或可能是一种连接）时，我确实只看到第一个表上的列，反之亦然，但看不到两个表的列数据。

let table1 = view() {
let table3 = view() {requests
| project name, itemCount
          | where name  ==  "ProcessApplicationLogs"
};
let table4 = view() {exceptions
| project operation_Name, itemCount
          | where operation_Name  ==  "ProcessApplicationLogs"
};
table3
| join kind=leftouter table4 on $left.name == $right.operation_Name
| summarize TotalExceptions = count() by tostring(name), tostring(itemCount)
};
table1;
let table2 = view() {
let table5 = view() {requests
| project name, itemCount
          | where name  ==  "ProcessApplicationLogs"
};
let table6 = view() {exceptions
| project operation_Name, itemCount
          | where operation_Name  ==  "ProcessApplicationLogs"
};
table5
| join kind=leftouter table6 on $left.name == $right.operation_Name
| summarize TotalExceptions = count() by tostring(operation_Name), tostring(itemCount)
};
table2
| join kind=leftouter table1 on $left.operation_Name == $right.name

Answer 1

当我使用下表数据尝试您的代码时，我得到了类似的结果。

let requests = datatable(name: string, itemCount: int)
[
    "ProcessApplicationLogs", 100,
    "OtherOperation1", 50,
    "ProcessApplicationLogs", 75
];

let exceptions = datatable(operation_Name: string, itemCount: int)
[
    "OtherOperation3", 5,
    "OtherOperation1", 10,
    "OtherOperation3", 7
];

let table1 = view() {
let table3 = view() {requests
| project name, itemCount
          | where name  ==  "ProcessApplicationLogs"
};
let table4 = view() {exceptions
| project operation_Name, itemCount
          | where operation_Name  ==  "ProcessApplicationLogs"
};
table3
| join kind=leftouter table4 on $left.name == $right.operation_Name
| summarize TotalExceptions = count() by tostring(name), tostring(itemCount)
};

let table2 = view() {
let table5 = view() {requests
| project name, itemCount
          | where name  ==  "ProcessApplicationLogs"
};
let table6 = view() {exceptions
| project operation_Name, itemCount
          | where operation_Name  ==  "ProcessApplicationLogs"
};
table5
| join kind=leftouter table6 on $left.name == $right.operation_Name
| summarize TotalExceptions = count() by tostring(operation_Name), tostring(itemCount)
};
table1
| join kind=leftouter table2 on $left.name == $right.operation_Name

当其中一张表中没有数据时，您可能会得到如上的结果。另外，清除缓存后，我得到了预期的结果。清除缓存后重新验证。如果仍然不起作用，您可以使用

project

使其工作，以包含右侧的表格列，例如

table1
| join kind=leftouter table2 on $left.name == $right.operation_Name
| project name,itemCount,TotalException, new_name=$right.operation_Name, new_count=itemCount,new_exceptions=$right.TotalExceptions