Feb 24 2020
12:30 PM
- last edited on
Apr 08 2022
10:18 AM
by
TechCommunityAP
Feb 24 2020
12:30 PM
- last edited on
Apr 08 2022
10:18 AM
by
TechCommunityAP
I'm trying to visualize the number of Heartbeats in 1 hour buckets for the last 48 hours. However, no matter what I use for an offset, I get a drop in amount at the beginning and end of the dataset:
How can I get rid of these in the visual (they're confusing)?
Feb 25 2020 01:01 AM
Solution
I suspect you have values below 300,000 due to the time you run the query, if it runs in the morning lets say 9am, you get a small count from midnight to 8am that day (where as the previous whole day will always have more results)- hence the lower number.
Heartbeat
| where TimeGenerated between (startofday(ago(2d))..startofday(ago(0d)))
| summarize Rows=count() by bin(TimeGenerated, 1h)
| render timechart
This would be a example to get two whole days (midnight to midnight), to get rid of those two varying data points. I'm a fan of "startofday" for this reason. https://docs.microsoft.com/en-us/azure/kusto/query/startofdayfunction
Feb 25 2020 04:13 AM
@CliveWatson to the rescue again. It trims my first bucket properly, but my last bucket still has that drop off--I can live with that. Thanks!
Feb 25 2020 01:01 AM
Solution
I suspect you have values below 300,000 due to the time you run the query, if it runs in the morning lets say 9am, you get a small count from midnight to 8am that day (where as the previous whole day will always have more results)- hence the lower number.
Heartbeat
| where TimeGenerated between (startofday(ago(2d))..startofday(ago(0d)))
| summarize Rows=count() by bin(TimeGenerated, 1h)
| render timechart
This would be a example to get two whole days (midnight to midnight), to get rid of those two varying data points. I'm a fan of "startofday" for this reason. https://docs.microsoft.com/en-us/azure/kusto/query/startofdayfunction