Forum Discussion
Solved
'DnsEvents | summarize by ClientIP, TimeGenerated' doesn't return expected result
When I execute the following query on the demo portal: DnsEvents | summarize by ClientIP, TimeGenerated It doesn't return what I expect. It seems the TimeGenerated is rounded to the nearest h...
Hi,
This is expected. It is a failsafe functionality in the system to protect it from returning huge amounts of records which will be the situation if we would have return every TimeGenerated in accuracy of a millisecond. It automatically use 1 hour binning.
We are evaluating this failsafe mechanism and consider if it worth keeping it.
If you want control over the binning period, you can use the bin function. This query does the same but use a 1 minute binning instead of the 1 hour binning:
DnsEvents | summarize count() by ClientIP, bin(TimeGenerated,1m)Thanks,
Meir :->
Thanks for the response. That makes sense. I'm just trying to understand Log Analytics and was reading through the docs on Materialize. There is a query that has a let assignment: let totalPagesPerDay = PageViews | summarize by Page, Day = startofday(Timestamp) | summarize count() by Day; This basically bins the PageViews by day (?) and was wondering if I could bin them by hour. Playing with DnsEvents I stumbled across this behavior and was thinking if I can't understand a fundamental query like this I must be missing something. Sorry if the question was off base.