Feb 21 2019
07:13 AM
- last edited on
Apr 07 2022
05:41 PM
by
TechCommunityAP
Feb 21 2019
07:13 AM
- last edited on
Apr 07 2022
05:41 PM
by
TechCommunityAP
I am seeing two different results from the same Log Analytics data set and don't understand why.
We are using Log Analytics to monitor our iis web servers.
If I run the query below is shows I have 15 errors from 3144 pages.
// failed request count by name
let start=datetime("2019-02-20T00:00:00.000Z");
let end=datetime("2019-02-20T23:59:00.000Z");
let dataset=requests
// additional filters can be applied here
| where timestamp > start and timestamp < end
| where client_Type != "Browser"
| where operation_Name == "POST assessmentForms/SaveAssessmentForm" ;
dataset
// change 'operation_Name' on the below line to segment by a different property
| summarize failedCount=sumif(itemCount, success == false), totalCount=sum(itemCount) by operation_Name
// calculate failed request count for all requests
This matches the results from my IIS logs on my web server.
However if I use the same query without the summarize line to look at the raw data in log analytics I only see 2 errors from 178 pages.
// failed request count by name
let start=datetime("2019-02-20T00:00:00.000Z");
let end=datetime("2019-02-20T23:59:00.000Z");
let dataset=requests
// additional filters can be applied here
| where timestamp > start and timestamp < end
| where client_Type != "Browser"
| where operation_Name == "POST assessmentForms/SaveAssessmentForm" ;
dataset
I dont understand the different results. What am I doing wrong and where is the additional data gone in the second query.
Thanks and all the best
Tom
Feb 22 2019 07:08 AM
Hi,
I think the differences comes from
itemCount
column. In that column you have different values. For example the value could be 1 or 10. This is caused by Telemetry sampling functionality. So the number of records in Application Insights does not corresponds exactly on total requests.
More on that here:
https://docs.microsoft.com/en-us/azure/azure-monitor/app/sampling
Let me know if that answers your question.