SOLVED

How to define the Y axis visualization of a barchart in the query

%3CLINGO-SUB%20id%3D%22lingo-sub-317751%22%20slang%3D%22en-US%22%3EHow%20to%20define%20the%20Y%20axis%20visualization%20of%20a%20barchart%20in%20the%20query%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-317751%22%20slang%3D%22en-US%22%3E%3CP%3EI%20have%20put%20together%20a%20query%20on%20event%20log%20data%20that%20I%20like%20that%20gives%20me%20the%20top%2010%20errors%20and%20warnings%20gathered%20from%20event%20logs%20by%20Computer%2C%20EventID%2C%20Source%2C%20EventLevelName%2C%20RenderedDescription.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIs%20there%20a%20way%20I%20can%20force%20the%20way%20the%20barchart%20visualizes%20the%20data%20in%20the%20query%3F%26nbsp%3B%3CBR%20%2F%3E%3CBR%20%2F%3EHere's%20how%20the%20current%20query%26nbsp%3Baggregates%20the%20data%3A%3C%2FP%3E%3CDIV%3E%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%3CBLOCKQUOTE%3E%3CDIV%3E%3CSPAN%3E%7C%20%3C%2FSPAN%3E%3CSPAN%3Esummarize%3C%2FSPAN%3E%3CSPAN%3E%20Occurances%3D%3C%2FSPAN%3E%3CSPAN%3Ecount%3C%2FSPAN%3E%3CSPAN%3E()%20%3C%2FSPAN%3E%3CSPAN%3Eby%3C%2FSPAN%3E%3CSPAN%3E%20Computer%2C%20EventID%2C%20Source%2C%20EventLevelName%2C%20RenderedDescription%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3E%7C%20%3C%2FSPAN%3E%3CSPAN%3Eorder%3C%2FSPAN%3E%20%3CSPAN%3Eby%3C%2FSPAN%3E%3CSPAN%3E%20Occurances%20desc%20nulls%20last%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3E%7C%20%3C%2FSPAN%3E%3CSPAN%3Etake%3C%2FSPAN%3E%20%3CSPAN%3E10%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3E%7C%20%3C%2FSPAN%3E%3CSPAN%3Erender%3C%2FSPAN%3E%3CSPAN%3E%20barchart%20kind%3Dstacked%3C%2FSPAN%3E%3C%2FDIV%3E%3C%2FBLOCKQUOTE%3E%3CDIV%3E%3CSPAN%3EThe%20barchart%20heading%20then%20shows%20%22Table%20Chart%20Stacked%20Column%20Computer%20EventID%20Source%20Sum%22%2C%20so%20the%20Computer%20is%20the%20X%20axis%2C%20EventID%20is%20the%20y%20axis%2C%20and%20Source%20is%20the%20graphed%20value.%26nbsp%3B%26nbsp%3B%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F67629iFAA07E12B04B15E8%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22Annotation%202019-01-15%20160902.png%22%20title%3D%22Annotation%202019-01-15%20160902.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3EI%20want%20%22Occurances%22%20as%20the%20Y%20axis%20so%20I%20click%20the%20drop%20down%20next%20to%20%22EventID%22%20and%20select%20%22Occurances%22%20to%20get%20it%20to%20do%20that.%26nbsp%3B%20Then%20the%20heading%20shows%20%22Table%20Chart%20Stacked%20Column%20Computer%20EventID%20Source%20Sum%22.%26nbsp%3B%20%26nbsp%3B%20%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F67633i399A5B06CCF791A2%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22Annotation%202019-01-15%20160831.png%22%20title%3D%22Annotation%202019-01-15%20160831.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3EI%20suspect%20I%20need%20to%20change%20something%20in%20the%20%22summarize%22%20clause%2C%20or%20the%20order%20by%20clause%2C%20but%20I'm%20struggling%26nbsp%3Bto%20figure%20out%20what%20I'm%20missing.%26nbsp%3B%20%26nbsp%3B%20How%20can%20I%20make%20the%20chart%20render%20with%20Occurances%20as%20the%20Y%20axis%20instead%20of%20EventID%3F%26nbsp%3B%26nbsp%3B%3C%2FSPAN%3E%3C%2FDIV%3E%3C%2FDIV%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-317751%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%20Log%20Analytics%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EQuery%20Language%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-318216%22%20slang%3D%22en-US%22%3ERe%3A%20How%20to%20define%20the%20Y%20axis%20visualization%20of%20a%20barchart%20in%20the%20query%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-318216%22%20slang%3D%22en-US%22%3E%3CP%3EI%20figured%20out%20what%20I%20was%20missing.%26nbsp%3B%20Changing%20the%20summary%20clause%20to%20this%2C%20did%20the%20trick%3A%3CBR%20%2F%3E%3CBR%20%2F%3E%3C%2FP%3E%3CDIV%3E%3CDIV%3E%3CSPAN%3Esummarize%3C%2FSPAN%3E%3CSPAN%3E%20Occurances%20%3D%20%3C%2FSPAN%3E%3CSPAN%3Ecount%3C%2FSPAN%3E%3CSPAN%3E(EventID)%20%3C%2FSPAN%3E%3CSPAN%3Eby%3C%2FSPAN%3E%3CSPAN%3E%20Computer%2C%20Source%2C%20EventLevelName%2C%20RenderedDescription%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%3C%2FDIV%3E%3C%2FLINGO-BODY%3E
Highlighted
New Contributor

I have put together a query on event log data that I like that gives me the top 10 errors and warnings gathered from event logs by Computer, EventID, Source, EventLevelName, RenderedDescription.

 

Is there a way I can force the way the barchart visualizes the data in the query? 

Here's how the current query aggregates the data:

 
| summarize Occurances=count() by Computer, EventID, Source, EventLevelName, RenderedDescription
| order by Occurances desc nulls last
| take 10
| render barchart kind=stacked
The barchart heading then shows "Table Chart Stacked Column Computer EventID Source Sum", so the Computer is the X axis, EventID is the y axis, and Source is the graphed value.  
Annotation 2019-01-15 160902.png
 
 
I want "Occurances" as the Y axis so I click the drop down next to "EventID" and select "Occurances" to get it to do that.  Then the heading shows "Table Chart Stacked Column Computer EventID Source Sum".   
Annotation 2019-01-15 160831.png
 
I suspect I need to change something in the "summarize" clause, or the order by clause, but I'm struggling to figure out what I'm missing.    How can I make the chart render with Occurances as the Y axis instead of EventID?  
1 Reply
Highlighted
Solution

I figured out what I was missing.  Changing the summary clause to this, did the trick:

summarize Occurances = count(EventID) by Computer, Source, EventLevelName, RenderedDescription