Nov 06 2017 07:30 AM - last edited on Nov 09 2023 11:10 AM by nzthiago
Hi,
I have a data set that when I use the summarize/bin over a 1 min interval has gaps in the data (hours) and when the timechart renders the graph the line goes directly from the last value in one set to the first value in the next set (so it looks like there is some data there).
Is there a way to have the summarize/bin function or the timechart to use zero (or some default value) for the buckets that I don't have data for?
-thanks
Nov 07 2017 02:37 AM
SolutionHi,
Please check out the make-series function to achieve this. For example, instead of saying:
You can say:
Feb 21 2018 10:07 AM
make-series with mvexpand doesn't work in a predictable way for me.
Take for example:
Perf | where CounterName == "Thread Count" | where InstanceName == "AgentService" | make-series avg(CounterValue) on TimeGenerated in range(ago(1d), now(), 30m) by Computer | mvexpand TimeGenerated , avg_CounterValue | project TimeGenerated=todatetime(TimeGenerated)-8h, Computer, Hits = toint(avg_CounterValue)
It will return 0 for all days when it should return 6.
If I run just up to the make-series part and examine one of the Computer series, the data looks partially correct. The last 24 hours for a given computer show 6, everything else is 0.
If I reduce the range from 7d to 1d, the data looks correct.
Is there something wrong with my query? Is there some limitation or bug I am running into?
Feb 21 2018 10:29 AM
Without seeing actual data, a couple of possibilities come to mind that might affect this:
let span = 7d; Perf | where TimeGenerated > ago(span) | where CounterName == "% Processor Time" | make-series avg(CounterValue) on TimeGenerated in range(ago(span), now(), 30m) by Computer | mvexpand TimeGenerated , avg_CounterValue | project TimeGenerated=todatetime(TimeGenerated)-8h, Computer, Hits = toint(avg_CounterValue)Adding the extra | where TimeGenerated... clause overrides the time picker.
Please give these two a shot, and if still not working, let me know and we can dig deeper.
Feb 21 2018 02:47 PM
You just saved my life! Both issues were at play and now the data looks correct. Thank you so much Evgeny 🙂
Jan 22 2019 06:36 AM
Sep 17 2019 12:39 PM
Found this super helpful as well when I was creating a time-series graph of some data that had several days with zero values. Much appreciated.
Nov 07 2017 02:37 AM
SolutionHi,
Please check out the make-series function to achieve this. For example, instead of saying:
You can say: