Get span of TimeGenerated to use in Summarize

%3CLINGO-SUB%20id%3D%22lingo-sub-2407166%22%20slang%3D%22en-US%22%3EGet%20span%20of%20TimeGenerated%20to%20use%20in%20Summarize%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2407166%22%20slang%3D%22en-US%22%3E%3CP%3EHi%3C%2FP%3E%3CP%3EI'm%20trying%20to%20figure%20out%20at%20way%20to%20make%20the%20round%20to%20value%20used%20in%20bin()%20dynamic.%3C%2FP%3E%3CP%3Eso%20if%20the%20Query%20is%20for%20a%20day%20I%20want%20to%20have%20something%20like%3A%3C%2FP%3E%3CP%3Ebin(Timegenerated%2C%201m)%26nbsp%3B%3C%2FP%3E%3CP%3Ebut%20if%20the%20query%20is%20for%2030%20days%20I%20want%20to%20have%20something%20like%3C%2FP%3E%3CP%3Ebin(Timegenerated%2C%201h)%3C%2FP%3E%3CP%3EWas%20thinking%20that%20I%20somehow%20could%20get%20the%20max%20and%20min%20from%20Timegenerated%20and%20then%20use%20%22case%22%20to%20set%20a%20variable%20to%20use%20in%20the%20last%26nbsp%3B%3C%2FP%3E%3CP%3E%7C%20summarize%20xxxxxx%20by%20bin(Timegenerated%2C%20%22variable%22)%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAnyone%20have%20some%20idea%20on%20how%20to%20do%20this%20%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E
Contributor

Hi

I'm trying to figure out at way to make the round to value used in bin() dynamic.

so if the Query is for a day I want to have something like:

bin(Timegenerated, 1m) 

but if the query is for 30 days I want to have something like

bin(Timegenerated, 1h)

Was thinking that I somehow could get the max and min from Timegenerated and then use "case" to set a variable to use in the last 

| summarize xxxxxx by bin(Timegenerated, "variable") 

 

Anyone have some idea on how to do this ?

0 Replies