Help with query: two graphs, one data set

%3CLINGO-SUB%20id%3D%22lingo-sub-985025%22%20slang%3D%22en-US%22%3EHelp%20with%20query%3A%20two%20graphs%2C%20one%20data%20set%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-985025%22%20slang%3D%22en-US%22%3E%3CP%3EI'm%20querying%20IIS%20logs%20and%20trying%20to%20create%20a%20graph%20that%20shows%20requests%20over%20time%20and%20errors%20over%20time%20on%20a%20single%20graph.%20I%20can%20display%20these%20two%20separately%2C%20but%20I'd%20like%20them%20to%20be%20in%20one%20graph%20if%20possible.%20I'm%20defining%20%22errors%22%20as%20toint(scStatus)%20%26gt%3B%3D%20500.%20I%20can%20get%20it%20to%20display%20multiple%20dimensions%20if%20I%20show%20all%20possible%20scStatus%20values%2C%20but%20I%20don't%20want%20the%20extra%20noise.%20How%20can%20I%20get%20it%20to%20show%20all%20requests%20over%20time%2C%20then%2C%20as%20another%20line%2C%20only%20the%20requests%20where%20scStatus%20is%20%26gt%3B%3D%20500%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F155015i47ABF7E143A05CF4%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20alt%3D%22clipboard_image_0.png%22%20title%3D%22clipboard_image_0.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-985025%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%20Log%20Analytics%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-985120%22%20slang%3D%22en-US%22%3ERe%3A%20Help%20with%20query%3A%20two%20graphs%2C%20one%20data%20set%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-985120%22%20slang%3D%22en-US%22%3E%3CP%3EI%20think%20this%20is%20the%20solution%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%7C%20summarize%20requests%20%3D%20count()%2C%3CBR%20%2F%3Eerrors%20%3D%20countif(toint(scStatus)%20%26gt%3B%3D%20500)%3CBR%20%2F%3Eby%20bin(TimeGenerated%2C%2010m)%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
New Contributor

I'm querying IIS logs and trying to create a graph that shows requests over time and errors over time on a single graph. I can display these two separately, but I'd like them to be in one graph if possible. I'm defining "errors" as toint(scStatus) >= 500. I can get it to display multiple dimensions if I show all possible scStatus values, but I don't want the extra noise. How can I get it to show all requests over time, then, as another line, only the requests where scStatus is >= 500?

 

clipboard_image_0.png

1 Reply
Highlighted

I think this is the solution:

 

| summarize requests = count(),
errors = countif(toint(scStatus) >= 500)
by bin(TimeGenerated, 10m)