Feb 11 2021 11:41 PM - edited Feb 11 2021 11:43 PM
I have followed this, to achieve the subject. However, I cannot get the expected output because of the timestamp. I need to configure the time range in the dashboard and not set in the query so that I can get various charts depending on the time range I select. I anyway could do the same with the below Kusto code to arrive with a chart. However, my expectation is to achieve the same with a time chart(Image is also attached at the bottom). Your ideas and thoughts on this will be a huge help for me.
let filterByName = 'event-name';
let events = dynamic(["*"]);
let mainTable = union customEvents
| extend name =replace("\n", "", name)
| where '*' in (events) or name in (events)
| where iff(isempty(filterByName), 1 == 1, name contains filterByName)
| where true;
let queryTable = mainTable;
let cohortedTable = queryTable
| extend dimension = customDimensions["vers"]
| extend dimension = iif(isempty(dimension), "<undefined>", dimension)
| summarize hll = hll(itemId) by tostring(dimension)
| extend Events = dcount_hll(hll)
| order by Events desc
| serialize rank = row_number()
| extend dimension = iff(rank > 5, 'Other', dimension)
| summarize merged = hll_merge(hll) by tostring(dimension)
| project ['vers'] = dimension, Counts = dcount_hll(merged);
cohortedTable
Feb 21 2021 07:31 PM - edited Feb 21 2021 07:33 PM
let filterByName = 'distribution-download';
let events = dynamic(["*"]);
let mainTable = union customEvents
| extend name =replace("\n", "", name)
| where '*' in (events) or name in (events)
| where iff(isempty(filterByName), 1 == 1, name contains filterByName)
| where true;
let queryTable = mainTable;
let cohortedTable = queryTable
| extend dimension = customDimensions["downloadedDistVersion"]
| extend dimension = iif(isempty(dimension), "<undefined>", dimension)
| summarize hll = hll(itemId) by tostring(dimension)
| extend Events = dcount_hll(hll)
| order by Events desc
| serialize rank = row_number()
| extend dimension = iff(rank > 5, 'Other', dimension)
| summarize merged = hll_merge(hll) by tostring(dimension);
cohortedTable
| union customEvents
| extend dimension = customDimensions["downloadedDistVersion"]
| summarize Count=count() by tostring(dimension), bin(timestamp, 1h)
| render timechart
This could be easily done by querying the required time chart in a new table defined as above: