Forum Discussion

parkavi11's avatar
parkavi11
Copper Contributor
Feb 11, 2021

Timechart with multiple dimension from custom properties

I have followed https://portal.azure.com/#blade/Microsoft_Azure_Monitoring_Logs/DemoLogsBlade/q/H4sIAAAAAAAAA1WOuwqDQBREe79iEAIKW2jAIoVpUqQLFpJ%2b1YkK7m64u%2bZFPj4PQsB6zjlMRTlFT1wHClGPhntaig7ssIXuXZJ3Kf7Azs02UA7aEGWJeIVKXEvvnXzl%2bIP62Rgt44PQlz75KUc9zUwVzpSWNowT%2fWJSKDKFTZECzR3NaJPFGYV8SN9t3gJth3oQ%2bsFNHUqss%2bgF6bL7icUAAAA%3d to achieve the subject. However, I cannot get the expected output because of the timestamp. I need to configure the time range in the dashboard and not set in the query so that I can get various charts depending on the time range I select. I anyway could do the same with the below Kusto code to arrive with a chart. However, my expectation is to achieve the same with a time chart(Image is also attached at the bottom). Your ideas and thoughts on this will be a huge help for me.

 

let filterByName = 'event-name';
let events = dynamic(["*"]);
let mainTable = union customEvents
    | extend name =replace("\n", "", name)
    | where '*' in (events) or name in (events)
    | where iff(isempty(filterByName), 1 == 1, name contains filterByName)
    | where true;
let queryTable = mainTable;
let cohortedTable = queryTable
    | extend dimension = customDimensions["vers"]
    | extend dimension = iif(isempty(dimension), "<undefined>", dimension)
    | summarize hll = hll(itemId) by tostring(dimension)
    | extend Events = dcount_hll(hll)
    | order by Events desc
    | serialize rank = row_number()
    | extend dimension = iff(rank > 5, 'Other', dimension)
    | summarize merged = hll_merge(hll) by tostring(dimension)
    | project ['vers'] = dimension, Counts = dcount_hll(merged);
cohortedTable

 

 

 

1 Reply

  • parkavi11's avatar
    parkavi11
    Copper Contributor

     

    let filterByName = 'distribution-download';
    let events = dynamic(["*"]);
    let mainTable = union customEvents
        | extend name =replace("\n", "", name)
        | where '*' in (events) or name in (events)
        | where iff(isempty(filterByName), 1 == 1, name contains filterByName)
        | where true;
    let queryTable = mainTable;
    let cohortedTable = queryTable
        | extend dimension = customDimensions["downloadedDistVersion"]
        | extend dimension = iif(isempty(dimension), "<undefined>", dimension)
        | summarize hll = hll(itemId) by tostring(dimension)
        | extend Events = dcount_hll(hll)
        | order by Events desc
        | serialize rank = row_number()
        | extend dimension = iff(rank > 5, 'Other', dimension)
        | summarize merged = hll_merge(hll) by tostring(dimension);
    cohortedTable
    | union customEvents
    | extend dimension = customDimensions["downloadedDistVersion"] 
    | summarize Count=count() by tostring(dimension), bin(timestamp, 1h)
    | render timechart 

     

    This could be easily done by querying the required time chart in a new table defined as above: