Incorrect results from Log Analytics

Copper Contributor

I am seeing two different results from the same Log Analytics data set and don't understand why.

 

We are using Log Analytics to monitor our iis web servers.

 

If I run the query below is shows I have 15 errors from 3144 pages.

// failed request count by name
let start=datetime("2019-02-20T00:00:00.000Z");
let end=datetime("2019-02-20T23:59:00.000Z");
let dataset=requests
// additional filters can be applied here
| where timestamp > start and timestamp < end
| where client_Type != "Browser"
| where operation_Name == "POST assessmentForms/SaveAssessmentForm" ;
dataset
// change 'operation_Name' on the below line to segment by a different property
| summarize failedCount=sumif(itemCount, success == false), totalCount=sum(itemCount) by operation_Name
// calculate failed request count for all requests

This matches the results from my IIS logs on my web server.

 

However if I use the same query without the summarize line to look at the raw data in log analytics I only see 2 errors from 178 pages.

// failed request count by name
let start=datetime("2019-02-20T00:00:00.000Z");
let end=datetime("2019-02-20T23:59:00.000Z");
let dataset=requests
// additional filters can be applied here
| where timestamp > start and timestamp < end
| where client_Type != "Browser"
| where operation_Name == "POST assessmentForms/SaveAssessmentForm" ;
dataset

I dont understand the different results. What am I doing wrong and where is the additional data gone in the second query.

 

Thanks and all the best

Tom

1 Reply

Hi,

I think the differences comes from

itemCount

column. In that column you have different values. For example the value could be 1 or 10. This is caused by Telemetry sampling functionality. So the number of records in Application Insights does not corresponds exactly on total requests.

More on that here:

https://docs.microsoft.com/en-us/azure/azure-monitor/app/sampling

Let me know if that answers your question.