Forum Discussion
Solved
'DnsEvents | summarize by ClientIP, TimeGenerated' doesn't return expected result
When I execute the following query on the demo portal: DnsEvents | summarize by ClientIP, TimeGenerated It doesn't return what I expect. It seems the TimeGenerated is rounded to the nearest h...
Hi,
This is expected. It is a failsafe functionality in the system to protect it from returning huge amounts of records which will be the situation if we would have return every TimeGenerated in accuracy of a millisecond. It automatically use 1 hour binning.
We are evaluating this failsafe mechanism and consider if it worth keeping it.
If you want control over the binning period, you can use the bin function. This query does the same but use a 1 minute binning instead of the 1 hour binning:
DnsEvents | summarize count() by ClientIP, bin(TimeGenerated,1m)Thanks,
Meir :->
Meir_Mendelovich
Microsoft
MicrosoftHi,
Here is a more compact way to write the first query:
PageViews | summarize count() by bin(Timestamp,1d)
You can also do 1 hour binning using bin(Timestamp,1h).
You can see all details on the bin functions here: https://docs.loganalytics.io/docs/Language-Reference/Scalar-functions/bin()
There are additional options for more advanced scenarios. For example, see this: https://docs.loganalytics.io/docs/Language-Reference/Scalar-functions/bin_at()
Your feedback on the confusion is good. This is why we think to eliminate the auto-binning functionality.
Here is a more compact way to write the first query:
PageViews | summarize count() by bin(Timestamp,1d)
You can also do 1 hour binning using bin(Timestamp,1h).
You can see all details on the bin functions here: https://docs.loganalytics.io/docs/Language-Reference/Scalar-functions/bin()
There are additional options for more advanced scenarios. For example, see this: https://docs.loganalytics.io/docs/Language-Reference/Scalar-functions/bin_at()
Your feedback on the confusion is good. This is why we think to eliminate the auto-binning functionality.
Ah, Thanks explicitly calling bin makes more sense.