Microsoft Secure Tech Accelerator
Apr 03 2024, 07:00 AM - 11:00 AM (PDT)
Microsoft Tech Community
SOLVED

Split visualisation in workbook

Brass Contributor

I'm working on a workbook/dashboard and I have this query which should show in a bar or area chart successful and failed logins by client app.

 

SigninLogs
| where TimeGenerated > ago(7d)
| where isnotempty(ClientAppUsed)
| extend Result= iff(ResultType in ("0") ,"failure" ,"success" )
| summarize count(UserPrincipalName) by ClientAppUsed, Result
 
When I enter this query in LA, I can make a chart that looks how I want but in the workbook the chart doesn't split by UserPrincipalName. How can I replicate the chart from LA to the workbook?
 
Images attached. Green tick is LA and red X is workbook.
4 Replies

@endakelly 

 

You can do this another way, when you edit the Column and with Column renderer options.  You could also colour code the results column 

 

 

 

Annotation 2020-03-27 150252.jpg

Thanks for the reply @CliveWatson 

 

That does work but it's not really what I'm after. Ideally I'd have a stacked chart so we could see the proportion of sign ins that were successful or failed versus the total.

 

It's very odd that the visualisation works in LA but not in the workbook.

best response confirmed by endakelly (Brass Contributor)
Solution

@endakelly 

 

How about splitting the count() ?

SigninLogs
| where TimeGenerated > ago(30d)
| where isnotempty(ClientAppUsed)
| extend Result= iff(ResultType ==0 ,"failure" ,"success" )
| summarize fail=countif(Result=="failure") , success=countif(Result=="success") by   ClientAppUsed

 

That's done it @CliveWatson. Thanks!

1 best response

Accepted Solutions
best response confirmed by endakelly (Brass Contributor)
Solution

@endakelly 

 

How about splitting the count() ?

SigninLogs
| where TimeGenerated > ago(30d)
| where isnotempty(ClientAppUsed)
| extend Result= iff(ResultType ==0 ,"failure" ,"success" )
| summarize fail=countif(Result=="failure") , success=countif(Result=="success") by   ClientAppUsed

 

View solution in original post