Render two differenet timebuckets

[Henrik Olofsson]

Is there a convenient way to render two different timebuckets in the same chart?

...

| summarize avg(something) by bin(timegenerated size a, size b)?

Regards,

Henrik

[#2]

Hi,

You need to summarize them separately and union them to have a single chart:

union (

Heartbeat

| where TimeGenerated > ago(30d)

| summarize Col1=count() by bin(TimeGenerated, 3d)

),

(

Heartbeat

| where TimeGenerated > ago(30d)

| summarize Col2=count() by bin(TimeGenerated, 2d)

)

| render timechart

Thanks,

Meir :>

[#3]

Thanks Meir, much appreciated.