Forum Discussion
parkavi11
Feb 11, 2021Copper Contributor
Timechart with multiple dimension from custom properties
I have followed https://portal.azure.com/#blade/Microsoft_Azure_Monitoring_Logs/DemoLogsBlade/q/H4sIAAAAAAAAA1WOuwqDQBREe79iEAIKW2jAIoVpUqQLFpJ%2b1YkK7m64u%2bZFPj4PQsB6zjlMRTlFT1wHClGPhntaig7ssIXuXZJ...
parkavi11
Feb 21, 2021Copper Contributor
let filterByName = 'distribution-download';
let events = dynamic(["*"]);
let mainTable = union customEvents
| extend name =replace("\n", "", name)
| where '*' in (events) or name in (events)
| where iff(isempty(filterByName), 1 == 1, name contains filterByName)
| where true;
let queryTable = mainTable;
let cohortedTable = queryTable
| extend dimension = customDimensions["downloadedDistVersion"]
| extend dimension = iif(isempty(dimension), "<undefined>", dimension)
| summarize hll = hll(itemId) by tostring(dimension)
| extend Events = dcount_hll(hll)
| order by Events desc
| serialize rank = row_number()
| extend dimension = iff(rank > 5, 'Other', dimension)
| summarize merged = hll_merge(hll) by tostring(dimension);
cohortedTable
| union customEvents
| extend dimension = customDimensions["downloadedDistVersion"]
| summarize Count=count() by tostring(dimension), bin(timestamp, 1h)
| render timechart
This could be easily done by querying the required time chart in a new table defined as above: