Timechart with multiple dimension from custom properties

Copper Contributor

I have followed this, to achieve the subject. However, I cannot get the expected output because of the timestamp. I need to configure the time range in the dashboard and not set in the query so that I can get various charts depending on the time range I select. I anyway could do the same with the below Kusto code to arrive with a chart. However, my expectation is to achieve the same with a time chart(Image is also attached at the bottom). Your ideas and thoughts on this will be a huge help for me.

 

let filterByName = 'event-name';
let events = dynamic(["*"]);
let mainTable = union customEvents
    | extend name =replace("\n", "", name)
    | where '*' in (events) or name in (events)
    | where iff(isempty(filterByName), 1 == 1, name contains filterByName)
    | where true;
let queryTable = mainTable;
let cohortedTable = queryTable
    | extend dimension = customDimensions["vers"]
    | extend dimension = iif(isempty(dimension), "<undefined>", dimension)
    | summarize hll = hll(itemId) by tostring(dimension)
    | extend Events = dcount_hll(hll)
    | order by Events desc
    | serialize rank = row_number()
    | extend dimension = iff(rank > 5, 'Other', dimension)
    | summarize merged = hll_merge(hll) by tostring(dimension)
    | project ['vers'] = dimension, Counts = dcount_hll(merged);
cohortedTable

 

Screenshot 2021-02-11 at 07.43.58.png

 

 

1 Reply

 

let filterByName = 'distribution-download';
let events = dynamic(["*"]);
let mainTable = union customEvents
    | extend name =replace("\n", "", name)
    | where '*' in (events) or name in (events)
    | where iff(isempty(filterByName), 1 == 1, name contains filterByName)
    | where true;
let queryTable = mainTable;
let cohortedTable = queryTable
    | extend dimension = customDimensions["downloadedDistVersion"]
    | extend dimension = iif(isempty(dimension), "<undefined>", dimension)
    | summarize hll = hll(itemId) by tostring(dimension)
    | extend Events = dcount_hll(hll)
    | order by Events desc
    | serialize rank = row_number()
    | extend dimension = iff(rank > 5, 'Other', dimension)
    | summarize merged = hll_merge(hll) by tostring(dimension);
cohortedTable
| union customEvents
| extend dimension = customDimensions["downloadedDistVersion"] 
| summarize Count=count() by tostring(dimension), bin(timestamp, 1h)
| render timechart 

 

This could be easily done by querying the required time chart in a new table defined as above: