Microsoft Security Tech Accelerator
Dec 06 2023, 07:00 AM - 12:00 PM (PST)
Microsoft Tech Community

Split visualisation in workbook

Brass Contributor

I'm working on a workbook/dashboard and I have this query which should show in a bar or area chart successful and failed logins by client app.


| where TimeGenerated > ago(7d)
| where isnotempty(ClientAppUsed)
| extend Result= iff(ResultType in ("0") ,"failure" ,"success" )
| summarize count(UserPrincipalName) by ClientAppUsed, Result
When I enter this query in LA, I can make a chart that looks how I want but in the workbook the chart doesn't split by UserPrincipalName. How can I replicate the chart from LA to the workbook?
Images attached. Green tick is LA and red X is workbook.
4 Replies



You can do this another way, when you edit the Column and with Column renderer options.  You could also colour code the results column 




Annotation 2020-03-27 150252.jpg

Thanks for the reply @CliveWatson 


That does work but it's not really what I'm after. Ideally I'd have a stacked chart so we could see the proportion of sign ins that were successful or failed versus the total.


It's very odd that the visualisation works in LA but not in the workbook.

best response confirmed by endakelly (Brass Contributor)



How about splitting the count() ?

| where TimeGenerated > ago(30d)
| where isnotempty(ClientAppUsed)
| extend Result= iff(ResultType ==0 ,"failure" ,"success" )
| summarize fail=countif(Result=="failure") , success=countif(Result=="success") by   ClientAppUsed


That's done it @CliveWatson. Thanks!