如何在App Insights事件中单独统计Windows 11系统数据？

核心修改逻辑 #

1. 先识别所有包含Windows 11的系统记录，统一归类为"Windows 11"
2. 调整Other分组规则，确保Windows 11无论排名如何都不会被合并到Other中

修改后的完整Kusto查询 #

let usg_events = dynamic(["*"]);
let mainTable = union pageViews, customEvents, requests
    | where timestamp > ago(1d)
    | where isempty(operation_SyntheticSource)
    | extend name = replace("\n", "", name)
    | where '*' in (usg_events) or name in (usg_events)
;
let queryTable = mainTable;
let cohortedTable = queryTable
    | extend dimension = tostring(client_OS)
    // 统一识别并标记所有Windows 11相关系统
    | extend dimension = iif(dimension contains "Windows 11", "Windows 11", 
                            iif(isempty(dimension), "<undefined>", dimension))
    | summarize hll = hll(itemId) by tostring(dimension)
    | extend Events = dcount_hll(hll)
    | order by Events desc
    | serialize rank = row_number()
    // 排除Windows 11，仅将排名5以外的其他系统归为Other
    | extend dimension = iff(rank > 5 and dimension != "Windows 11", 'Other', dimension)
    | summarize merged = hll_merge(hll) by tostring(dimension)
    | project ["Operating system"] = dimension, Counts = dcount_hll(merged);
cohortedTable

关键细节说明 #

• 使用dimension contains "Windows 11"：能匹配所有带Windows 11字样的系统值（比如"Windows 11 Pro"、"Windows 11 22H2"），避免因系统名称带后缀导致归类分散
• 调整后的Other规则：确保Windows 11即使用户量较少、排名在第5位之后，依然会单独显示，不会被合并到Other分组
• 保留原有的<undefined>逻辑：系统字段为空的记录仍会单独归类

内容的提问来源于stack exchange，提问作者Kev