Get span of TimeGenerated to use in Summarize



I'm trying to figure out at way to make the round to value used in bin() dynamic.

so if the Query is for a day I want to have something like:

bin(Timegenerated, 1m) 

but if the query is for 30 days I want to have something like

bin(Timegenerated, 1h)

Was thinking that I somehow could get the max and min from Timegenerated and then use "case" to set a variable to use in the last 

| summarize xxxxxx by bin(Timegenerated, "variable") 


Anyone have some idea on how to do this ?

0 Replies