appinsight中的子字符串

您可以使用“parse”操作符将开始时间和结束时间解析为各自的列:

| parse eventText with * "FinalStep-Start: " start " | End: " end

但因为 datetimes are not in a standard supported by analytics 我无法将它们转换为DateTime进行进一步处理:

range x from 1 to 1 step 1
| extend eventText = "FinalStep-Start: 12:11:20.467 | End: 12:11:20.936"
| parse eventText with * "FinalStep-Start: " start " | End: " end
| extend start_dt = todatetime(start) 
| extend end_dt = todatetime(end)