Help with query: two graphs, one data set

Copper Contributor

I'm querying IIS logs and trying to create a graph that shows requests over time and errors over time on a single graph. I can display these two separately, but I'd like them to be in one graph if possible. I'm defining "errors" as toint(scStatus) >= 500. I can get it to display multiple dimensions if I show all possible scStatus values, but I don't want the extra noise. How can I get it to show all requests over time, then, as another line, only the requests where scStatus is >= 500?

 

clipboard_image_0.png

1 Reply

I think this is the solution:

 

| summarize requests = count(),
errors = countif(toint(scStatus) >= 500)
by bin(TimeGenerated, 10m)