Render two differenet timebuckets

%3CLINGO-SUB%20id%3D%22lingo-sub-128965%22%20slang%3D%22en-US%22%3ERender%20two%20differenet%20timebuckets%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-128965%22%20slang%3D%22en-US%22%3E%3CP%3EIs%20there%20a%20convenient%20way%20to%20render%20two%20different%20timebuckets%20in%20the%20same%20chart%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E...%3C%2FP%3E%3CP%3E%7C%20summarize%20avg(something)%20by%20bin(timegenerated%20size%20a%2C%20size%20b)%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ERegards%2C%3C%2FP%3E%3CP%3EHenrik%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-128965%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EQuery%20Language%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-129672%22%20slang%3D%22en-US%22%3ERe%3A%20Render%20two%20differenet%20timebuckets%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-129672%22%20slang%3D%22en-US%22%3E%3CP%3EThanks%20Meir%2C%20much%20appreciated.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-129356%22%20slang%3D%22en-US%22%3ERe%3A%20Render%20two%20differenet%20timebuckets%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-129356%22%20slang%3D%22en-US%22%3E%3CP%3EHi%2C%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EYou%20need%20to%20summarize%20them%20separately%20and%20union%20them%20to%20have%20a%20single%20chart%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CDIV%3E%0A%3CDIV%3E%3CSPAN%3Eunion%3C%2FSPAN%3E%3CSPAN%3E%20(%3C%2FSPAN%3E%3C%2FDIV%3E%0A%3CDIV%3E%3CSPAN%3E%20Heartbeat%3C%2FSPAN%3E%3C%2FDIV%3E%0A%3CDIV%3E%3CSPAN%3E%7C%20%3C%2FSPAN%3E%3CSPAN%3Ewhere%3C%2FSPAN%3E%3CSPAN%3E%20TimeGenerated%20%26gt%3B%20ago(%3C%2FSPAN%3E%3CSPAN%3E30%3C%2FSPAN%3E%3CSPAN%3Ed)%3C%2FSPAN%3E%3C%2FDIV%3E%0A%3CDIV%3E%3CSPAN%3E%7C%20%3C%2FSPAN%3E%3CSPAN%3Esummarize%3C%2FSPAN%3E%3CSPAN%3E%20Col1%3D%3C%2FSPAN%3E%3CSPAN%3Ecount%3C%2FSPAN%3E%3CSPAN%3E()%20%3C%2FSPAN%3E%3CSPAN%3Eby%3C%2FSPAN%3E%3CSPAN%3E%20bin(TimeGenerated%2C%203%3C%2FSPAN%3E%3CSPAN%3Ed)%3C%2FSPAN%3E%3C%2FDIV%3E%0A%3CDIV%3E%3CSPAN%3E)%2C%20%3C%2FSPAN%3E%3C%2FDIV%3E%0A%3CDIV%3E%3CSPAN%3E(%20%3C%2FSPAN%3E%3C%2FDIV%3E%0A%3CDIV%3E%3CSPAN%3E%20Heartbeat%3C%2FSPAN%3E%3C%2FDIV%3E%0A%3CDIV%3E%3CSPAN%3E%7C%20%3C%2FSPAN%3E%3CSPAN%3Ewhere%3C%2FSPAN%3E%3CSPAN%3E%20TimeGenerated%20%26gt%3B%20ago(%3C%2FSPAN%3E%3CSPAN%3E30%3C%2FSPAN%3E%3CSPAN%3Ed)%3C%2FSPAN%3E%3C%2FDIV%3E%0A%3CDIV%3E%3CSPAN%3E%7C%20%3C%2FSPAN%3E%3CSPAN%3Esummarize%3C%2FSPAN%3E%3CSPAN%3E%20Col2%3D%3C%2FSPAN%3E%3CSPAN%3Ecount%3C%2FSPAN%3E%3CSPAN%3E()%20%3C%2FSPAN%3E%3CSPAN%3Eby%3C%2FSPAN%3E%3CSPAN%3E%20bin(TimeGenerated%2C%20%3C%2FSPAN%3E%3CSPAN%3E2%3C%2FSPAN%3E%3CSPAN%3Ed)%3C%2FSPAN%3E%3C%2FDIV%3E%0A%3CDIV%3E%3CSPAN%3E)%3C%2FSPAN%3E%3C%2FDIV%3E%0A%3CDIV%3E%3CSPAN%3E%7C%20%3C%2FSPAN%3E%3CSPAN%3Erender%3C%2FSPAN%3E%3CSPAN%3E%20timechart%3C%2FSPAN%3E%3C%2FDIV%3E%0A%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%0A%3CDIV%3E%3CSPAN%3EThanks%2C%3C%2FSPAN%3E%3C%2FDIV%3E%0A%3CDIV%3E%3CSPAN%3EMeir%20%3A%26gt%3B%3C%2Fimg%3E%3C%2FSPAN%3E%3C%2FDIV%3E%0A%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%0A%3C%2FDIV%3E%3C%2FLINGO-BODY%3E
Highlighted
New Contributor

Is there a convenient way to render two different timebuckets in the same chart?

 

...

| summarize avg(something) by bin(timegenerated size a, size b)?

 

Regards,

Henrik

2 Replies
Highlighted

Hi,

 

You need to summarize them separately and union them to have a single chart:

 

union (
Heartbeat
| where TimeGenerated > ago(30d)
| summarize Col1=count() by bin(TimeGenerated, 3d)
),
(
Heartbeat
| where TimeGenerated > ago(30d)
| summarize Col2=count() by bin(TimeGenerated, 2d)
)
| render timechart
 
Thanks,
Meir :>
 
Highlighted

Thanks Meir, much appreciated.