Forum Discussion

sunnypatel's avatar
sunnypatel
Copper Contributor
Mar 09, 2019

Standard Deviation in AppInsights query

I want to be able to get alerted from AppInsights whenever the number of errors in 15min time "buckets" exceeds 2 standard deviations from the norm. 

Here is an example of what I've tried thus far:

 

let x =
toscalar(customEvents
| where name contains "Vendor"
| where customDimensions.OperationResult != "Success"
| summarize RequestCount=count() by OperationResult=tostring(customDimensions.OperationResult), bin(timestamp, 15min)
| summarize stdev(RequestCount));

customEvents
| where name contains "Vendor"
| where customDimensions.OperationResult != "Success"
| summarize RequestCount=count() by OperationResult=tostring(customDimensions.OperationResult), bin(timestamp, 15min)
| where RequestCount >= (x * 2)
 
However this query errors with "'where' operator: Failed to resolve column or scalar expression named 'x'"
 
This seems like a pretty basic request for an analytics service so I'm sure I'm missing something here.
 
Thanks
azure monitor
Query Language

1 Reply

  • Ketan Ghelani's avatar
    Ketan Ghelani
    Former Employee
    Mar 11, 2019

    The query seems to be fine.  You just have an extra blank link after completion of your let statement.

    let x =
    toscalar(customEvents
    | where name contains "Vendor"
    | where customDimensions.OperationResult != "Success"
    | summarize RequestCount=count() by OperationResult=tostring(customDimensions.OperationResult), bin(timestamp, 15min)
    | summarize stdev(RequestCount));
    customEvents
    | where name contains "Vendor"
    | where customDimensions.OperationResult != "Success"
    | summarize RequestCount=count() by OperationResult=tostring(customDimensions.OperationResult), bin(timestamp, 15min)
    | where RequestCount >= (x * 2)

Resources