SOLVED

Barchart when the returned result is zero

%3CLINGO-SUB%20id%3D%22lingo-sub-3217550%22%20slang%3D%22en-US%22%3EBarchart%20when%20the%20returned%20result%20is%20zero%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3217550%22%20slang%3D%22en-US%22%3E%3CP%3EHi%2C%20we%20want%20to%20create%20a%20barchart%20for%20the%20severity%20of%20the%20incident.%20However%2C%20we%20only%20have%20High%20incident%20now.%20The%20result%20could%20not%20show%20the%20zero%20for%20the%20medium%20and%20low.%20Is%20there%20any%20other%20alternative%20approach%20for%20it%3F%20Thanks.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CPRE%20class%3D%22lia-code-sample%20language-applescript%22%3E%3CCODE%3ESecurityIncident%20%0A%7Csummarize%20count()%20by%20Severity%0A%7C%20render%20barchart%3C%2FCODE%3E%3C%2FPRE%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22Steven_Su_1-1645946545255.png%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F351476i0F48E4F86EE736A0%2Fimage-size%2Flarge%3Fv%3Dv2%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22Steven_Su_1-1645946545255.png%22%20alt%3D%22Steven_Su_1-1645946545255.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-3217550%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EDashboards%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EKQL%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EKusto%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-3219799%22%20slang%3D%22en-US%22%3ERe%3A%20Barchart%20when%20the%20returned%20result%20is%20zero%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3219799%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F1310945%22%20target%3D%22_blank%22%3E%40Steven_Su%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThis%20will%20create%20a%20entry%20for%20any%20named%20Severity%20of%20Zero%3C%2FP%3E%3CPRE%20class%3D%22lia-code-sample%20language-cpp%22%3E%3CCODE%3Elet%20Sev_%20%3D%20dynamic(%5B'High'%2C'Medium'%2C'Low'%2C'Informational'%5D)%3B%0ASecurityIncident%20%0A%7Cmv-expand%20NewSev%3DSev_%0A%7Csummarize%20Count%20%3D%20countif(NewSev%3D%3DSeverity)%20by%20Severity%3Dtostring(NewSev)%3C%2FCODE%3E%3C%2FPRE%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22Clive_Watson_0-1646033003881.png%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F351652i8FC90AB540EA7FBB%2Fimage-size%2Fmedium%3Fv%3Dv2%26amp%3Bpx%3D400%22%20role%3D%22button%22%20title%3D%22Clive_Watson_0-1646033003881.png%22%20alt%3D%22Clive_Watson_0-1646033003881.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E
Contributor

Hi, we want to create a barchart for the severity of the incident. However, we only have High incident now. The result could not show the zero for the medium and low. Is there any other alternative approach for it? Thanks.

 

 

SecurityIncident 
|summarize count() by Severity
| render barchart

 

 

Steven_Su_1-1645946545255.png

 

 

2 Replies
best response confirmed by Steven_Su (Contributor)
Solution

@Steven_Su 

This will create a entry for any named Severity of Zero

let Sev_ = dynamic(['High','Medium','Low','Informational']);
SecurityIncident 
|mv-expand NewSev=Sev_
|summarize Count = countif(NewSev==Severity) by Severity=tostring(NewSev)

Clive_Watson_0-1646033003881.png

 

 

Thanks for the reply and it is indeed the answer I want!