Microsoft Secure Tech Accelerator
Apr 03 2024, 07:00 AM - 11:00 AM (PDT)
Microsoft Tech Community
SOLVED

Barchart when the returned result is zero

Copper Contributor

Hi, we want to create a barchart for the severity of the incident. However, we only have High incident now. The result could not show the zero for the medium and low. Is there any other alternative approach for it? Thanks.

 

 

SecurityIncident 
|summarize count() by Severity
| render barchart

 

 

Steven_Su_1-1645946545255.png

 

 

2 Replies
best response confirmed by Steven_Su (Copper Contributor)
Solution

@Steven_Su 

This will create a entry for any named Severity of Zero

let Sev_ = dynamic(['High','Medium','Low','Informational']);
SecurityIncident 
|mv-expand NewSev=Sev_
|summarize Count = countif(NewSev==Severity) by Severity=tostring(NewSev)

Clive_Watson_0-1646033003881.png

 

 

Thanks for the reply and it is indeed the answer I want!
1 best response

Accepted Solutions
best response confirmed by Steven_Su (Copper Contributor)
Solution

@Steven_Su 

This will create a entry for any named Severity of Zero

let Sev_ = dynamic(['High','Medium','Low','Informational']);
SecurityIncident 
|mv-expand NewSev=Sev_
|summarize Count = countif(NewSev==Severity) by Severity=tostring(NewSev)

Clive_Watson_0-1646033003881.png

 

 

View solution in original post