查询输出并获取最新文件名 [英] Query the ouput and get latest file name

问题描述

下面是Kusto查询:

Below is the kusto query:

ADFActivityRun
| where PipelineName contains "MyPipeline" 
| where OperationName == "Failed" 
| order by TimeGenerated desc
| take 1

输出"列给出以下结果:

The Output column gives below result:

    "{
  ""name"": ""varFileNames"",
  ""value"": [
    {
      ""name"": ""Z400_EEE_20191110_ERR.txt"",
      ""type"": ""File""
    },
    {
      ""name"": ""Z400_CCC_20191119_ERR.txt"",
      ""type"": ""File""
    },
    {
      ""name"": ""Z400_DDD_20191121_ERR.txt"",
      ""type"": ""File""
    },
    {
      ""name"": ""Z400_EEE_20191122_ERR.txt"",
      ""type"": ""File""
    },
    {
      ""name"": ""Z400_AAA_20191202_ERR.txt"",
      ""type"": ""File""
    }
  ]
}"

文件名中包含yyyymmdd.我只想获取最新的文本文件名.在上述情况下-Z400_AAA_20191202_ERR.txt

File names has yyyymmdd in it. I want to get only the text file name which is latest. In above case - Z400_AAA_20191202_ERR.txt

目的是发送警报-上面的错误文件可用，请检查此文件"

Intent is to send alert that - "The above error file is available, please check this file"

推荐答案

您可以使用mv-apply来实现.

例如:

print d = dynamic({
    "name": "varFileNames",
    "value": [
        {
            "name": "Z400_EEE_20191110_ERR.txt",
            "type": "File"
        },
        {
            "name": "Z400_CCC_20191119_ERR.txt",
            "type": "File"
        },
        {
            "name": "Z400_DDD_20191121_ERR.txt",
            "type": "File"
        },
        {
            "name": "Z400_EEE_20191122_ERR.txt",
            "type": "File"
        },
        {
            "name": "Z400_AAA_20191202_ERR.txt",
            "type": "File"
        }
    ]
})
| mv-apply value = d.value on (
    parse value.name with * "_" * "_" dt:datetime "_" *
    | top 1 by dt desc
    | project name = value.name
)
| project name

这篇关于查询输出并获取最新文件名的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！