Home

Render two differenet timebuckets

Henrik Olofsson
New Contributor

Is there a convenient way to render two different timebuckets in the same chart?

 

...

| summarize avg(something) by bin(timegenerated size a, size b)?

 

Regards,

Henrik

2 Replies

Hi,

 

You need to summarize them separately and union them to have a single chart:

 

union (
Heartbeat
| where TimeGenerated > ago(30d)
| summarize Col1=count() by bin(TimeGenerated, 3d)
),
(
Heartbeat
| where TimeGenerated > ago(30d)
| summarize Col2=count() by bin(TimeGenerated, 2d)
)
| render timechart
 
Thanks,
Meir :>
 

Thanks Meir, much appreciated.