KQL查询仅显示周日数据，其余日期显示未知的问题求助

问题原因 #

你的查询里，dayofweek(timestamp)函数返回的是浮点型数值（范围是0.0到6.999...，其中0.0代表周日），但你用了严格的整数相等判断（比如DayOfWeek == 1）。只有当timestamp刚好是当天0点整时，DayOfWeek才会是整数，其余时间的DayOfWeek都是带小数的浮点数，导致case里的分支都不匹配，最终返回“Onbekend”。

修正后的查询代码 #

方案一：将浮点型转换为整数

把dayofweek(timestamp)的结果转为整数，确保和case里的判断值类型匹配：

union isfuzzy=true
    availabilityResults,
    requests,
    exceptions,
    pageViews,
    traces,
    customEvents,
    dependencies
| where * has "Login"
| extend DayOfWeek = toint(dayofweek(timestamp)) 
| extend DayName = case(
    DayOfWeek == 0, "Zondag",
    DayOfWeek == 1, "Maandag",
    DayOfWeek == 2, "Dinsdag",
    DayOfWeek == 3, "Woensdag",
    DayOfWeek == 4, "Donderdag",
    DayOfWeek == 5, "Vrijdag",
    DayOfWeek == 6, "Zaterdag",
    "Onbekend"
)
| extend Day = format_datetime(timestamp, 'yyyy-MM-dd')
| summarize Login = count() by Day, DayName
| order by Day asc
| render columnchart kind=stacked

方案二：直接生成荷兰语星期名称（更简洁）

用format_datetime函数直接指定区域获取荷兰语星期名，省去手动写case的麻烦：

union isfuzzy=true
    availabilityResults,
    requests,
    exceptions,
    pageViews,
    traces,
    customEvents,
    dependencies
| where * has "Login"
| extend DayName = format_datetime(timestamp, 'dddd', 'nl-NL')
| extend Day = format_datetime(timestamp, 'yyyy-MM-dd')
| summarize Login = count() by Day, DayName
| order by Day asc
| render columnchart kind=stacked

学习建议 #

• 优先查看KQL官方文档里的函数说明，明确每个函数的返回值类型，比如dayofweek的返回值是real而非int
• 测试单个函数的返回值可以用print语句，比如print dayofweek(now())，快速验证结果类型和数值
• 注意类型匹配：比较操作符两边的类型要一致，避免浮点数和整数直接用==做严格匹配

内容的提问来源于stack exchange，提问作者Erwin