'DnsEvents | summarize by ClientIP, TimeGenerated' doesn't return expected result

Hi,

This is expected. It is a failsafe functionality in the system to protect it from returning huge amounts of records which will be the situation if we would have return every TimeGenerated in accuracy of a millisecond. It automatically use 1 hour binning.

We are evaluating this failsafe mechanism and consider if it worth keeping it. 

If you want control over the binning period, you can use the bin function. This query does the same but use a 1 minute binning instead of the 1 hour binning:

Thanks,

Meir :->