Hi Dapeng Li,
Put shortly - once you apply the first `summarize` by instance name and computer, you lose the TimeGenerated column. I suggest you add the "bin" you use on the second `summarize` to the first one.
Additionally, when you use "join" you might over-complicate the query, and make it less efficient.
I suggest the following query (changed the first string to match our demo data)
let containerNames = Perf
| where InstanceName like 'e4272367-5645-4c4e-9c67-3b74b59a6982'
| where ObjectName == 'K8SContainer'
| where CounterName == "memoryRssBytes"
| distinct InstanceName;
Perf
| where InstanceName in (containerNames)
| where CounterName == "memoryRssBytes"
| extend usage = tolong(CounterValue)
| extend usageMB = usage * 1.0/(1024*1024)
| summarize maxUsageMB=max(usageMB) by InstanceName, Computer, bin(TimeGenerated, 2h)
| summarize sum(maxUsageMB) by Computer, bin(TimeGenerated, 2h)
HTH,
Noa