SOLVED

KQL to only get values during office hours

%3CLINGO-SUB%20id%3D%22lingo-sub-1641550%22%20slang%3D%22en-US%22%3EKQL%20to%20only%20get%20values%20during%20office%20hours%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1641550%22%20slang%3D%22en-US%22%3E%3CP%3EHi%2C%20im%20trying%20to%20get%20insightdata%20for%20office%20hours%20only.%20all%20examples%20i%20find%20is%20for%20one%20day%20only%20but%20I%20want%20to%20have%20a%20graph%20for%20a%20week%20but%20only%206am%20to%2016pm.%20Can't%20figure%20it%20out.%20Anyone%20that%20can%20help.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CDIV%3E%3CDIV%3E%3CSPAN%3EInsightsMetrics%20%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3E%7C%20%3C%2FSPAN%3E%3CSPAN%3Ewhere%3C%2FSPAN%3E%3CSPAN%3E%20Computer%20%3C%2FSPAN%3E%3CSPAN%3Econtains%3C%2FSPAN%3E%20%3CSPAN%3E%22servername%22%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3E%7C%20%3C%2FSPAN%3E%3CSPAN%3Ewhere%3C%2FSPAN%3E%3CSPAN%3E%20Name%20%3D%3D%20%3C%2FSPAN%3E%3CSPAN%3E%22WriteBytesPerSecond%22%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3E%7C%20%3C%2FSPAN%3E%3CSPAN%3Ewhere%3C%2FSPAN%3E%3CSPAN%3E%20parse_json%3C%2FSPAN%3E%3CSPAN%3E(%3C%2FSPAN%3E%3CSPAN%3ETags%3C%2FSPAN%3E%3CSPAN%3E).%5B%3C%2FSPAN%3E%3CSPAN%3E%22vm.azm.ms%2FmountId%22%3C%2FSPAN%3E%3CSPAN%3E%5D%3C%2FSPAN%3E%3CSPAN%3E%20%3D%3D%20%3C%2FSPAN%3E%3CSPAN%3E%22F%3A%22%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3E%7C%20%3C%2FSPAN%3E%3CSPAN%3Esummarize%3C%2FSPAN%3E%3CSPAN%3E%20sum%3C%2FSPAN%3E%3CSPAN%3E(%3C%2FSPAN%3E%3CSPAN%3EVal%3C%2FSPAN%3E%3CSPAN%3E)%3C%2FSPAN%3E%20%3CSPAN%3Eby%3C%2FSPAN%3E%3CSPAN%3E%20Computer%3C%2FSPAN%3E%3CSPAN%3E%2C%3C%2FSPAN%3E%3CSPAN%3E%20bin%3C%2FSPAN%3E%3CSPAN%3E(%3C%2FSPAN%3E%3CSPAN%3ETimeGenerated%3C%2FSPAN%3E%3CSPAN%3E%2C%3C%2FSPAN%3E%20%3CSPAN%3E24%3C%2FSPAN%3E%3CSPAN%3Eh%3C%2FSPAN%3E%3CSPAN%3E)%3C%2FSPAN%3E%3C%2FDIV%3E%3C%2FDIV%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1642994%22%20slang%3D%22en-US%22%3ERe%3A%20KQL%20to%20only%20get%20values%20during%20office%20hours%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1642994%22%20slang%3D%22en-US%22%3E%3CP%3EHi%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F577472%22%20target%3D%22_blank%22%3E%40PatrikHansson%3C%2FA%3E%26nbsp%3B%2C%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ETry%20using%20hourofday()%20function%20and%20then%20filter%20the%20hours.%3C%2FP%3E%0A%3CP%3ELink%20to%20the%20function%20dcumentation%3A%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fdata-explorer%2Fkusto%2Fquery%2Fhourofdayfunction%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fdata-explorer%2Fkusto%2Fquery%2Fhourofdayfunction%3C%2FA%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EExample%3A%3C%2FP%3E%0A%3CPRE%20class%3D%22lia-code-sample%20language-applescript%22%3E%3CCODE%3EInsightsMetrics%0A%7C%20where%20TimeGenerated%20%26gt%3B%20ago(7d)%0A%7C%20extend%20Hour%20%3D%20hourofday(TimeGenerated)%0A%7C%20where%20Hour%20%26gt%3B%3D%206%20and%20Hour%20%26lt%3B%2016%0A%7C%20summarize%20sum(Val)%20by%20Computer%2C%20bin(TimeGenerated%2C%2024h)%3C%2FCODE%3E%3C%2FPRE%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ERafi%3C%2FP%3E%3C%2FLINGO-BODY%3E
Contributor

Hi, im trying to get insightdata for office hours only. all examples i find is for one day only but I want to have a graph for a week but only 6am to 16pm. Can't figure it out. Anyone that can help.

 

InsightsMetrics
| where Computer contains "servername"
| where Name == "WriteBytesPerSecond"
| where parse_json(Tags).["vm.azm.ms/mountId"] == "F:"
| summarize sum(Val) by Computer, bin(TimeGenerated, 24h)
2 Replies
Best Response confirmed by PatrikHansson (Contributor)
Solution

Hi @PatrikHansson ,

 

Try using hourofday() function and then filter the hours.

Link to the function dcumentation: https://docs.microsoft.com/en-us/azure/data-explorer/kusto/query/hourofdayfunction

 

Example:

InsightsMetrics
| where TimeGenerated > ago(7d)
| extend Hour = hourofday(TimeGenerated)
| where Hour >= 6 and Hour < 16
| summarize sum(Val) by Computer, bin(TimeGenerated, 24h)

 

Rafi

@Rafi_Rabo Thanks...so simple :flushed: