Forum Discussion
How to have a time chart show zero for missing/null data.
Hi, I have a data set that when I use the summarize/bin over a 1 min interval has gaps in the data (hours) and when the timechart renders the graph the line goes directly from the last value in o...
Hi,
Please check out the make-series function to achieve this. For example, instead of saying:
Heartbeat| where TimeGenerated > ago(1d)| summarize count() by Computer, bin(TimeGenerated, 1h)You can say:
Heartbeat| make-series count() default=0 on TimeGenerated in range(ago(1d), now(), 1h) by ComputerThe output is a bit different for make-series (you get an array for datetimes and an array for the count for each computer rather than a row combination for each), so if you want the data in the same format that summarize produces, you can do so via mvexpand:Heartbeat| make-series count() default=0 on TimeGenerated in range(ago(1d), now(), 1h) by Computer| mvexpand count_, TimeGenerated
Evgeny Ternovsky
Microsoft
MicrosoftHi,
Please check out the make-series function to achieve this. For example, instead of saying:
Heartbeat
| where TimeGenerated > ago(1d)
| summarize count() by Computer, bin(TimeGenerated, 1h)
You can say:
Heartbeat
| make-series count() default=0 on TimeGenerated in range(ago(1d), now(), 1h) by Computer
The output is a bit different for make-series (you get an array for datetimes and an array for the count for each computer rather than a row combination for each), so if you want the data in the same format that summarize produces, you can do so via mvexpand:
Heartbeat
| make-series count() default=0 on TimeGenerated in range(ago(1d), now(), 1h) by Computer
| mvexpand count_, TimeGenerated
How to make "make-series" work with time range on portal instead of hard coding the value/specifying the relative time range.
range(ago(1d), now(), 1h)
If I change the time range from portal to say last 7 days, how to make it work with "make-series" without editing the query ?
range(ago(1d), now(), 1h)
If I change the time range from portal to say last 7 days, how to make it work with "make-series" without editing the query ?