Forum Discussion
Timechart with multiple dimension from custom properties
I have followed https://portal.azure.com/#blade/Microsoft_Azure_Monitoring_Logs/DemoLogsBlade/q/H4sIAAAAAAAAA1WOuwqDQBREe79iEAIKW2jAIoVpUqQLFpJ%2b1YkK7m64u%2bZFPj4PQsB6zjlMRTlFT1wHClGPhntaig7ssIXuXZJ3Kf7Azs02UA7aEGWJeIVKXEvvnXzl%2bIP62Rgt44PQlz75KUc9zUwVzpSWNowT%2fWJSKDKFTZECzR3NaJPFGYV8SN9t3gJth3oQ%2bsFNHUqss%2bgF6bL7icUAAAA%3d to achieve the subject. However, I cannot get the expected output because of the timestamp. I need to configure the time range in the dashboard and not set in the query so that I can get various charts depending on the time range I select. I anyway could do the same with the below Kusto code to arrive with a chart. However, my expectation is to achieve the same with a time chart(Image is also attached at the bottom). Your ideas and thoughts on this will be a huge help for me.
let filterByName = 'event-name';
let events = dynamic(["*"]);
let mainTable = union customEvents
| extend name =replace("\n", "", name)
| where '*' in (events) or name in (events)
| where iff(isempty(filterByName), 1 == 1, name contains filterByName)
| where true;
let queryTable = mainTable;
let cohortedTable = queryTable
| extend dimension = customDimensions["vers"]
| extend dimension = iif(isempty(dimension), "<undefined>", dimension)
| summarize hll = hll(itemId) by tostring(dimension)
| extend Events = dcount_hll(hll)
| order by Events desc
| serialize rank = row_number()
| extend dimension = iff(rank > 5, 'Other', dimension)
| summarize merged = hll_merge(hll) by tostring(dimension)
| project ['vers'] = dimension, Counts = dcount_hll(merged);
cohortedTable
1 Reply
- parkavi11Copper Contributor
let filterByName = 'distribution-download'; let events = dynamic(["*"]); let mainTable = union customEvents | extend name =replace("\n", "", name) | where '*' in (events) or name in (events) | where iff(isempty(filterByName), 1 == 1, name contains filterByName) | where true; let queryTable = mainTable; let cohortedTable = queryTable | extend dimension = customDimensions["downloadedDistVersion"] | extend dimension = iif(isempty(dimension), "<undefined>", dimension) | summarize hll = hll(itemId) by tostring(dimension) | extend Events = dcount_hll(hll) | order by Events desc | serialize rank = row_number() | extend dimension = iff(rank > 5, 'Other', dimension) | summarize merged = hll_merge(hll) by tostring(dimension); cohortedTable | union customEvents | extend dimension = customDimensions["downloadedDistVersion"] | summarize Count=count() by tostring(dimension), bin(timestamp, 1h) | render timechartThis could be easily done by querying the required time chart in a new table defined as above: