Help requested with log analytics query for Application Gateway timechart

Hi, Can anyone help out a starting log analytics rookie? I am trying to troubleshoot performance on an Application Gateway and noticed a specific IP has a high amount of hits compared to the others...

azure monitor

Query Language

Evgeny Ternovsky
May 30, 2018
Hi Bart,

If I understand your question correctly, you're looking for the bin() command. I've also cleaned up the rest of your query to be more performant. Try to avoid "search" whenever possible to improve your query times; in this case, since you know the table name and column names where your data is, filter by them directly.

AzureDiagnostics | where ResourceType == "APPLICATIONGATEWAYS" and Resource == "mygateway" | where clientIP_s == "1.1.1.1" | summarize count() by bin(TimeGenerated, 1h) | render timechart

Note that while I'm using "1h" here as the size of bucket which you want to examine, I could just as easily say "2m" (2 minute buckets), "30s" (30 seconds), etc.

Thanks,

-Evgeny

Evgeny Ternovsky

Microsoft

May 30, 2018

Hi Bart,

If I understand your question correctly, you're looking for the bin() command. I've also cleaned up the rest of your query to be more performant. Try to avoid "search" whenever possible to improve your query times; in this case, since you know the table name and column names where your data is, filter by them directly.

AzureDiagnostics
| where ResourceType == "APPLICATIONGATEWAYS" and Resource == "mygateway"
| where clientIP_s == "1.1.1.1"
| summarize count() by bin(TimeGenerated, 1h)
| render timechart

Note that while I'm using "1h" here as the size of bucket which you want to examine, I could just as easily say "2m" (2 minute buckets), "30s" (30 seconds), etc.

Thanks,

-Evgeny