Forum Discussion
Split visualisation in workbook
I'm working on a workbook/dashboard and I have this query which should show in a bar or area chart successful and failed logins by client app.
SigninLogs
| where TimeGenerated > ago(7d)
| where isnotempty(ClientAppUsed)
| extend Result= iff(ResultType in ("0") ,"failure" ,"success" )
| summarize count(UserPrincipalName) by ClientAppUsed, Result
When I enter this query in LA, I can make a chart that looks how I want but in the workbook the chart doesn't split by UserPrincipalName. How can I replicate the chart from LA to the workbook?
Images attached. Green tick is LA and red X is workbook.
How about splitting the count() ?
SigninLogs | where TimeGenerated > ago(30d) | where isnotempty(ClientAppUsed) | extend Result= iff(ResultType ==0 ,"failure" ,"success" ) | summarize fail=countif(Result=="failure") , success=countif(Result=="success") by ClientAppUsed
- CliveWatson
Microsoft
You can do this another way, when you edit the Column and with Column renderer options. You could also colour code the results column
Thanks for the reply CliveWatson
That does work but it's not really what I'm after. Ideally I'd have a stacked chart so we could see the proportion of sign ins that were successful or failed versus the total.
It's very odd that the visualisation works in LA but not in the workbook.
- CliveWatson
How about splitting the count() ?
SigninLogs | where TimeGenerated > ago(30d) | where isnotempty(ClientAppUsed) | extend Result= iff(ResultType ==0 ,"failure" ,"success" ) | summarize fail=countif(Result=="failure") , success=countif(Result=="success") by ClientAppUsed
