Forum Discussion
OmriPinsker
Jul 20, 2020Copper Contributor
Union on timechart
Hi CliveWatson when using the connectors timechart table, i have modified it to be alligned with our Logsources. can you clarify clarify about the syntax and the unions and how they work 1. the r...
CliveWatson
Jul 21, 2020Former Employee
If you need a different date range for each Table, then this maybe better: Go to Log Analytics and run query
union
(
Heartbeat
// go back two days and get a bin for each day
| where TimeGenerated > startofday(ago(2d))
| summarize Count=count() by bin_at(TimeGenerated, 1d, now())
| order by TimeGenerated
| project Value = iff(isnull(Count), 0 , Count), Time = TimeGenerated, Legend = "Table1: Heartbeat"
),
(
Perf
// go back seven days and get a bin for each day
| where TimeGenerated > startofday(ago(7d))
| summarize Count=count() by bin_at(TimeGenerated, 1d, now())
| order by TimeGenerated
// perf is a high count so added a /1000 to reduce the scale - please remove
| project Value = iff(isnull(Count), 0 , Count / 1000), Time = TimeGenerated, Legend = "Table2: Perf"
)
| render timechart
Count and max(Count) would have been the same in the examples given, so I removed that line.
OmriPinsker
Jul 21, 2020Copper Contributor
tnx,
ended up doing something similar,
FYI the initial query is used from the connector UI