KQL question

Microsoft

Jun 28, 2020

Try:

let total = toscalar(AzureActivity | summarize count());
AzureActivity 
| summarize Operations = count(), LastActivity = max (TimeGenerated) by ResourceGroup, ResourceProvider 
| project ResourceProvider, ResourceGroup, Operations, LastActivity, precetage = 1.0 * Operations / total 
| sort by Operations

Note that you don't need the join for the max aggregation function as you can have multiple aggregation functions in a single summarize operator.

In practice, the above should be:

let Activity = materialize (AzureActivity 
| summarize Operations = count(), LastActivity = max (TimeGenerated) by ResourceGroup, ResourceProvider 
| project ResourceProvider, ResourceGroup, Operations, LastActivity);
let total = toscalar(Activity | summarize sum(Operations));
Activity 
| extend precetage = 1.0 * Operations / total 
| sort by Operations

Why?

Without materialize (i.e. caching partial results), the two uses of AzureActivity may differ as their run is slightly shifted in time.
Once I did materialzie, I wanted to optimize performance so wanted to cache the least, hence breaking it up to three stages.

Forum Discussion