共用方式為


range operator

Applies to: ✅Microsoft FabricAzure Data ExplorerAzure MonitorMicrosoft Sentinel

產生值的單一數據行數據表。

Note

此運算子不會接受表格式輸入。

Syntax

range columnNamefromstarttostopstepstep

Learn more about syntax conventions.

Parameters

Name 類型 Required Description
columnName string ✔️ 輸出數據表中單一數據行的名稱。
start int、long、real、datetime 或 timespan ✔️ 輸出中的最小值。
stop int、long、real、datetime 或 timespan ✔️ The highest value being generated in the output or a bound on the highest value if step is over this value.
step int、long、real、datetime 或 timespan ✔️ 兩個連續值之間的差異。

Note

值無法參考任何數據表的數據行。 If you want to compute the range based on an input table, use the range function potentially with the mv-expand operator.

Returns

A table with a single column called columnName, whose values are start, start+step, ... up to and until stop.

Examples

本節中的範例示範如何使用 語法來協助您開始使用。

The examples in this article use publicly available tables in the help cluster, such as the StormEvents table in the Samples database.

The examples in this article use publicly available tables, such as the Weather table in the Weather analytics sample gallery. 您可能需要修改範例查詢中的資料表名稱,以符合工作區中的資料表。

過去七天的範圍

下列範例會建立一個數據表,其中包含過去七天一天一次的目前時間戳專案。

range LastWeek from ago(7d) to now() step 1d

Output

LastWeek
2015-12-05 09:10:04.627
2015-12-06 09:10:04.627
...
2015-12-12 09:10:04.627

結合不同的停止時間

下列範例示範如何使用 union 運算符來擴充範圍,以使用多次停止時間。

let Range1 = range Time from datetime(2024-01-01) to datetime(2024-01-05) step 1d;
let Range2 = range Time from datetime(2024-01-06) to datetime(2024-01-10) step 1d;
union Range1, Range2
| order by Time asc

Output

Time
2024-01-04 00:00:00.0000000
2024-01-05 00:00:00.0000000
2024-01-06 00:00:00.0000000
2024-01-07 00:00:00.0000000
2024-01-08 00:00:00.0000000
2024-01-09 00:00:00.0000000
2024-01-10 00:00:00.0000000

使用參數的範圍

下列範例示範如何使用 range 運算元搭配參數,然後以數據表的形式擴充和取用。

let toUnixTime = (dt:datetime) 
{ 
    (dt - datetime(1970-01-01)) / 1s 
};
let MyMonthStart = startofmonth(now()); //Start of month
let StepBy = 4.534h; //Supported timespans
let nn = 64000; // Row Count parametrized
let MyTimeline = range MyMonthHour from MyMonthStart to now() step StepBy
| extend MyMonthHourinUnixTime = toUnixTime(MyMonthHour), DateOnly = bin(MyMonthHour,1d), TimeOnly = MyMonthHour - bin(MyMonthHour,1d)
; MyTimeline | order by MyMonthHour asc | take nn

Output

MyMonthHour MyMonthHourinUnixTime DateOnly TimeOnly
2023-02-01 00:00:00.0000000 1675209600 2023-02-01 00:00:00.0000000
2023-02-01 04:32:02.4000000 1675225922.4 2023-02-01 00:00:00.0000000
2023-02-01 09:04:04.8000000 1675242244.8 2023-02-01 00:00:00.0000000
2023-02-01 13:36:07.2000000 1675258567.2 2023-02-01 00:00:00.0000000
... ... ... ...

Incremented steps

下列範例會建立一個數據表,其類型為 Steps 且其類型為 long,並將值從一個遞增到八個遞增三個。

range Steps from 1 to 8 step 3

Output

Steps
1
4
7

一段時間內的追蹤

下列範例示範如何使用 range 運算符來建立維度數據表,以用來引進源數據沒有值的零。 這需要過去四個小時的時間戳,並計算每一分鐘間隔的追蹤。 當特定間隔沒有追蹤時,計數為零。

range TIMESTAMP from ago(4h) to now() step 1m
| join kind=fullouter
  (Traces
      | where TIMESTAMP > ago(4h)
      | summarize Count=count() by bin(TIMESTAMP, 1m)
  ) on TIMESTAMP
| project Count=iff(isnull(Count), 0, Count), TIMESTAMP
| render timechart