Barchart ignoring one data series

Copper Contributor
The following query 
 
Heartbeat
| where TimeGenerated >= startofday(ago(2d))
| where Computer == "ADMIN-PC" or Computer == "SERVER-PC"
| summarize dcount(Computer) by t = endofday(TimeGenerated) , Computer
| sort by t, Computer
| render barchart kind=default
 
produces the following table of 6 record in two sets:
 
Table.JPG
I'd expect to see a barchart with two series, but the result only shows one:
 
Barchart.JPG
 
The behavour is consistent. When I chose three series only two will be displayed. Do I miss anything?
 
Regards Jörg
 
7 Replies
Wouldn't you show it as 'unstacked'? e.g change the last line to:

| render barchart kind=unstacked

@CliveWatson 

 

thx for the reply! When changing on unstacked everything looks fine.

Barchart.JPG

 

I dived a little more into the previous stacked barchart diagramm. There the Y-scale starts at 1. That might be the reason one series doesn't seem to show up. In my opinion for a stacked barchart diagram the Y-scale always must start at 0.

 

Regards Joergs

You can use https://docs.microsoft.com/en-us/azure/kusto/query/make-seriesoperator to backfill the required 0s (zeros). Have a look, when I have some time later I'll see if I have an example

@CliveWatson 

 

I simplyfied the qurey so it can be executed in Azure Data Explorer and in Azure Log analytics workspace. The query is:

 

[Execute Query] [cluster('help.kusto.windows.net').database('Samples')]

datatable(TimeGenerated:datetime, Computer: string)
[datetime(2019-06-25T01:59:59.999),"SERVER-PC",  
datetime(2019-06-25T01:59:59.999),"ADMIN-PC",        
datetime(2019-06-24T01:59:59.999),"ADMIN-PC",      
datetime(2019-06-24T01:59:59.999),"SERVER-PC",    
datetime(2019-06-23T01:59:59.999),"SERVER-PC" ]
| where TimeGenerated >= startofday(datetime(2019-06-23T01:59:59.999))
| summarize dcount(Computer) by t = endofday(TimeGenerated) , Computer
| sort by t, Computer
| render columnchart with ( kind=stacked, ymin = 0)
 

When executing in Azure data explorer the result renders correctly:

BarchartA.JPG

 

Running the same query in log analytics results in this:

Barchart.JPG

 

As mentinoed befort the Server-PC series is not displayed. I suppose that is because of the y-scale starts at 1. It seems when one series is contained in all colums, the scaling mechanism starts above. The ymin parameter is ignored.

 

Regards

Jörg

@joergha Please remember Log Analytics is a subset of ADX, so some things are not available in both - like the Y-axis,  please see:

 

https://docs.microsoft.com/en-gb/azure/azure-monitor/log-query/log-query-overview and especially https://docs.microsoft.com/en-gb/azure/azure-monitor/log-query/data-explorer-difference  - however I will coincide its not a full list.  

Go to Log Analytics and Run Query - would this work for you (only in Log Analytics) ?

@CliveWatson 

 

would work! Thanks a lot!