Forum Discussion
utegrad
Jan 15, 2019Copper Contributor
How to define the Y axis visualization of a barchart in the query
I have put together a query on event log data that I like that gives me the top 10 errors and warnings gathered from event logs by Computer, EventID, Source, EventLevelName, RenderedDescription.
Is there a way I can force the way the barchart visualizes the data in the query?
Here's how the current query aggregates the data:
| summarize Occurances=count() by Computer, EventID, Source, EventLevelName, RenderedDescription| order by Occurances desc nulls last| take 10| render barchart kind=stacked
The barchart heading then shows "Table Chart Stacked Column Computer EventID Source Sum", so the Computer is the X axis, EventID is the y axis, and Source is the graphed value.
I want "Occurances" as the Y axis so I click the drop down next to "EventID" and select "Occurances" to get it to do that. Then the heading shows "Table Chart Stacked Column Computer EventID Source Sum".
I suspect I need to change something in the "summarize" clause, or the order by clause, but I'm struggling to figure out what I'm missing. How can I make the chart render with Occurances as the Y axis instead of EventID?
I figured out what I was missing. Changing the summary clause to this, did the trick:
summarize Occurances = count(EventID) by Computer, Source, EventLevelName, RenderedDescription
1 Reply
- utegradCopper Contributor
I figured out what I was missing. Changing the summary clause to this, did the trick:
summarize Occurances = count(EventID) by Computer, Source, EventLevelName, RenderedDescription