hi.
I'm using kql for log management.
What I want to know is that I want to find and sort the max value of each user among the various user's data
In this case, which command should I use?
hi.
I'm using kql for log management.
What I want to know is that I want to find and sort the max value of each user among the various user's data
In this case, which command should I use?
You can use the sort command, refer to Write queries for Azure Data Explorer | Microsoft Docs and the examples below.
['events.all'] | where FullName_Name == "player_virtual_currency_balance_changed" | sort by tostring(EventData.VirtualCurrencyBalance) desc | project Entity_Id,EventData.VirtualCurrencyBalance
If the user' data you say refers to Player Data, then it should be noted that no events are automatically generated when the data in Player Data is updated. You need to manually generate events for data updates via WritePlayerEvent so that you can query the data in the Data Explorer (advanced).
Also, for player data that needs to be sorted, you may consider using statistics and leaderboards.
Is there any way to find the data without overlapping the entity_id does not overlap?
I thought it was distinct, but I don't think it is
You can try summarize.
['events.all'] | where FullName_Name == "player_virtual_currency_balance_changed" | sort by Entity_Id,tostring(EventData.VirtualCurrencyBalance) desc | project Entity_Id,EventData.VirtualCurrencyBalance | summarize arg_max(tostring(EventData_VirtualCurrencyBalance),*) by Entity_Id
Also, I'm not an expert on Kusto, for more advanced queries, please refer to Kusto documentation.
14 People are following this question.
