SOLVED

How to define the Y axis visualization of a barchart in the query

Copper Contributor

I have put together a query on event log data that I like that gives me the top 10 errors and warnings gathered from event logs by Computer, EventID, Source, EventLevelName, RenderedDescription.

 

Is there a way I can force the way the barchart visualizes the data in the query? 

Here's how the current query aggregates the data:

 
| summarize Occurances=count() by Computer, EventID, Source, EventLevelName, RenderedDescription
| order by Occurances desc nulls last
| take 10
| render barchart kind=stacked
The barchart heading then shows "Table Chart Stacked Column Computer EventID Source Sum", so the Computer is the X axis, EventID is the y axis, and Source is the graphed value.  
Annotation 2019-01-15 160902.png
 
 
I want "Occurances" as the Y axis so I click the drop down next to "EventID" and select "Occurances" to get it to do that.  Then the heading shows "Table Chart Stacked Column Computer EventID Source Sum".   
Annotation 2019-01-15 160831.png
 
I suspect I need to change something in the "summarize" clause, or the order by clause, but I'm struggling to figure out what I'm missing.    How can I make the chart render with Occurances as the Y axis instead of EventID?  
1 Reply
best response confirmed by Stanislav Zhelyazkov (MVP)
Solution

I figured out what I was missing.  Changing the summary clause to this, did the trick:

summarize Occurances = count(EventID) by Computer, Source, EventLevelName, RenderedDescription
 
 
1 best response

Accepted Solutions
best response confirmed by Stanislav Zhelyazkov (MVP)
Solution

I figured out what I was missing.  Changing the summary clause to this, did the trick:

summarize Occurances = count(EventID) by Computer, Source, EventLevelName, RenderedDescription
 
 

View solution in original post