删除95%的最高计数Kusto查询

// 步骤1：分组和计数
datatable MyTable (timestamp:datetime, value:int)
{
    // 表数据
}
| summarize count() by timestamp
| order by count_ desc

// 步骤3：计算总计数
let totalCount = toscalar(MyTable | count());

// 步骤4-6：删除95%的最高计数
let countThreshold = toscalar(totalCount * 0.95);
let deletedCount = 0;
MyTable
| summarize count() by timestamp
| order by count_ desc
| project timestamp, count_
| where deletedCount < countThreshold or isnull(count_)
| invoke 
{
    // 步骤5：累计计数值
    let curCount = toscalar(count_);
    let isNullCount = isnull(curCount);
    let curCountValid = iif(isNullCount, 0, curCount);
    let countDiff = toscalar(countThreshold - deletedCount - curCountValid);
    
    // 步骤6：删除标记的分组
    let deleteFlag = iif(!isNullCount && countDiff >= 0, 1, 0);
    let deleteCount = iif(deleteFlag, curCountValid, 0);
    let updateCount = iif(deleteFlag, deleteCount, curCount);
    let newDeletedCount = deletedCount + deleteCount;
    
    deletedCount = newDeletedCount;
    updateCount
}