I am looking for help with Kusto query:
| where test == "Jump" and Time > 2
| where test == "Run" and Time > 20
| where test == "Stand" and Time > 5
It is interesting because I am not getting error message, however I should get results...
At least I get results when I run where commands separately, but when I execute query as one, no results...any idea why?
Test Time
Jump 10
Run 13
Stand 15
Jump 5
Run 15
Stand 4
The query you included is the equivalent of:
...
| where test == "Jump" and Time > 2
and test == "Run" and Time > 20
and test == "Stand" and Time > 5
| ...
In the data set you've provided, the intersection (and) of all of the conditions you included is empty, therefore no records are returned:
| where test == "Jump" and Time > 2: 2 matching records are (Jump, 10), (Jump, 5)
| where test == "Run" and Time > 20: there are no matching records.
| where test == "Stand" and Time > 5: 1 matching record is (Stand, 15)
I think your intention was to use the or keyword, e.g.:
...
| where (test == "Jump" and Time > 2)
or (test == "Run" and Time > 20)
or (test == "Stand" and Time > 5)
| ...
Otherwise, you'll need to clarify what the expected output is.
Related
I am very new to Kusto queries and I have one that is giving me the proper data that I export to Excel to manage. My only problem is that I only care (right now) about yesterday and today in two separate Sheets. I can manually change the datetime with the information but I would like to be able to just refresh the data and it pull the newest number.
It sounds pretty simple but I cannot figure out how to specify the exact time I want. Has to be from 2 am day 1 until 1:59 day 2
Thanks
['Telemetry.WorkStation']
| where NexusUid == "08463c7b-fe37-43b6-a0d2-237472b9774d"
| where TelemetryLocalTimeStamp >= make_datetime(2023,2,15,2,0,0) and TelemetryLocalTimeStamp < make_datetime(2023,2,16,01,59,0)
| where NumberOfBinPresentations >0
ago(), now(), startofday() and some datetime arithmetic.
// Sample data generation. Not part of the solution.
let ['Telemetry.WorkStation'] = materialize(range i from 1 to 1000000 step 1 | extend NexusUid = "08463c7b-fe37-43b6-a0d2-237472b9774d", TelemetryLocalTimeStamp = ago(2d * rand()));
// Solution starts here.
['Telemetry.WorkStation']
| where NexusUid == "08463c7b-fe37-43b6-a0d2-237472b9774d"
| where TelemetryLocalTimeStamp >= startofday(ago(1d)) + 2h
and TelemetryLocalTimeStamp < startofday(now()) + 2h
| summarize count(), min(TelemetryLocalTimeStamp), max(TelemetryLocalTimeStamp)
count_
min_TelemetryLocalTimeStamp
max_TelemetryLocalTimeStamp
500539
2023-02-15T02:00:00.0162031Z
2023-02-16T01:59:59.8883692Z
Fiddle
I am trying to display result using Kusto KQL query in pie chart.The goal is to display pie chart as half n half color in case of failure and full color in case of pass.
Basically log from a site displays rows as pass and failed row .In case where all are pass , pie chart should display 100 % same color.In case of even single failure in any rows , it should display 50% one color and 50% other color.Below query works when 1) When all rows are pass as full color 2) when some are pass and some fail or even one fails (displays pie chart in half n half) color 3)BUT WHEN ALL ROW HAS FAILS ,this is displaying in one color and not splitting pie chart in half n half
QUERY I USED:
results
| where Name contains "jobqueues"
| where timestamp > ago(1h)
| extend PASS = (ErLvl)>2 )
| extend FAIL = ((ErLvl<2 )
| project PASS ,FAIL
| extend status = iff(PASS==true,"PASS","FAIL")
| summarize count() by status
| extend display = iff(count_>0,1,0)
| summarize percentile(display, 50) by status
| render piechart
Please suggest what can be done to solve this problem.Thanks in advance.
Let's summarize your question:
There are only two outcomes of your query:
A piechart showing 50% vs 50%
A piechart showing 100%
From your description we learn that when
All rows are PASS we plot piechart 2.
Any row has FAIL we plot piechart 1.
Lets see how we can achieve this after this line from your code:
| extend status = iff(PASS==true,"PASS","FAIL")
| summarize count() by status
We should have a table looking like so:
status
count_
PASS
x
FAIL
y
Looks like we need to perform some logic on this. You were originally plotting based on the operation result. My idea was to just generate a table of pass = 1 and fail = 1 for the 50%v50% case and another table of pass = 1 and fail = 0 for the 100% case.
So following that logic we need to perform the following mapping:
status
count_
status
count2
fail
>0
maps to
fail
1
pass
>0
pass
1
status
count_
status
count2
fail
>0
maps to
fail
1
pass
=0
pass
1
status
count_
status
count2
fail
=0
maps to
fail
0
pass
>0
pass
1
Logical representation:
(given count_ >=0):
if fail > 0 count2 = 0 else count 1
pass is always equal to 1
We only need to apply this to the row where status == FAILED but summarize doesn't guarantee a row if there are no observations
Guarantee summarize results:
| extend fail_count = iif(status == "FAIL", count_, 0)
| extend pass_count = iif(status == "PASS", count_, 0)
| project fail_count,pass_count
| summarize sum(fail_count), sum(pass_count)
Apply logic
| extend FAIL = iff(sum_fail_count > 0, 1, 0)
| extend PASS = 1
| project FAIL, PASS
Now our result is looking like:
PASS
FAIL
1
1 or 0
In order to plot this as a pie chart we just need to transpose it so the columns PASSED and FAILED are rows of the "status" column.
We can use a simple pack and mv-expand for this
//transpose for rendering
| extend tmp = pack("FAIL",FAIL,"PASS",PASS)
| mv-expand kind=array tmp
| project Status=tostring(tmp[0]), Count=toint(tmp[1])
| render piechart
And that's it!~
Final query:
results
| where Name contains "jobqueues"
| where timestamp > ago(1h)
| extend PASS = (ErLvl)>2 )
| extend FAIL = ((ErLvl<2 )
| project PASS ,FAIL
| extend status = iff(PASS==true,"PASS","FAIL")
| summarize count() by status
//ensure results
| extend fail_count = iif(status == "FAIL", count_, 0)
| extend pass_count = iif(status == "PASS", count_, 0)
| project fail_count,pass_count
| summarize sum(fail_count), sum(pass_count)
//apply logic
| extend FAIL = iff(sum_fail_count > 0, 1, 0)
| extend PASS = 1
| project FAIL, PASS
//transpose for rendering
| extend Temp = pack("FAIL",FAIL,"PASS",PASS)
| mv-expand kind=array Temp
| project Status=tostring(Temp[0]), Count=toint(Temp[1])
| render piechart
I have a data that looks as follows:
Date | Time | Temperature
16995 | "12:00" | 23
16995 | "12:30" | 24
...
17499 | "23:30" | 23
17500 | "00:00" | 24
I'm writing a function to select a range of cases based on certain start and end time points. To do this I need to determine the start_pt and end_pt indices which should match with a pair of rows in the dataframe.
select_case <- function(df,date,time) {
start_pt = 0
end_pt = 0
for (i in 1:nrow(df)) {
if ((date[i] == 17000) & (time[i] == "12:00")) {
start_pt <- i
return(start_pt)
} else {
next
}
}
for (i in start_pt:nrow(df)) {
if (date[i] == 17500) {
end_pt <- i - 1
return(end_pt)
break
} else {
next
}
}
return(df[start_pt:end_pt,])
}
When I called:
test <- select_case(data,data$Date,data$Time)
test
I expect the following:
Date | Time | Temperature
17000 | "12:00" | 23
17000 | "12:30" | 24
...
17499 | "23:00" | 23
17499 | "23:30" | 23
Instead i got
[1] 1
Not sure where i got it wrong here. When I separately ran each of the two for-loops from R console and substituting in the corresponding arguments for each loop, i got the correct indices for both start_pt and end_pt.
I tried putting each loop in a separate function, named sta(date,time) and end(date). Then I bind them in the following function:
binder <- function(date,time) {
return(sta(date,time),end(date))
}
and call
sta_end <- binder(date,time)
I got the error:
Error in return(sta(date, time), end(date)) :
multi-argument returns are not permitted
So i combined them and it worked:
binder <- function(date,time) {
return(c(sta(date,time),end(date)))
}
sta_end <- binder(date,time)
[1] 1 <an index for end_pt>
So the mistake i made in my original function is that i use return() 3 times and the function will only return the first one which is start_pt. So I took out the first two return() and retained the last one:
return(df[start_pt:end_pt,])
This worked, i got the expected result.
Could you please help me how to set own name for each test case into Data Driven to make report more readable.
REAL REPORT EXAMPLE:
Status: FAIL (critical)
Message: Several failures occurred:
1) ******************************
FAIL: Wrong value received. Expected: 0 . Actual: 3
2) ******************************
FAIL: Wrong value received. Expected: 0 . Actual: 3
3) ******************************
FAIL: Wrong value received. Expected: 0 . Actual: 3
But it is not clear from the output about details. And I would like to have some details instead of ***************,
THAT I NEED :
Status: FAIL (critical)
Message: Several failures occurred:
1) if param is empty
FAIL: Wrong value received. Expected: 0 . Actual: 3
2) if param is out of range
FAIL: Wrong value received. Expected: 0 . Actual: 3
3) if param is something more
FAIL: Wrong value received. Expected: 0 . Actual: 3
I have these detail as ${comment} for each table line into data driven. Could you please help me how to assign it for each test case inside data driven to have more understandable report.
DATA DRIVEN TEST EXAMPLE
st_ddt_test_example
[Template] st_ddt_test_example_keyword
# comment # # value setup # # value expected #
if param is empty 0 0
if param is out of range 100 0
if param is something more -8 0
Your keyword controls the error that is displayed, so it just needs to include the name as part of the error message.
Here is an example:
*** Keywords ***
Example
[Arguments] ${comment} ${1} ${2}
should be equal ${1} ${2}
... ${comment}: '${1}' != '${2}'
... False
*** Test Cases ***
Test 1
[Template] example
Test 1.0 a b
Test 1.1 b c
Test 1.2 c d
When run, the test yields the following results:
Test 1 | FAIL |
Several failures occurred:
1) Test 1.0: 'a' != 'b'
2) Test 1.1: 'b' != 'c'
3) Test 1.2: 'c' != 'd'
I am trying to get the value for the column Max, which is the max value of columns A, B, C. The rows T and G are Total and Grand total (because of row groups), I only need the max value for them :
-----------------------------
A B C | Max
-----------------------------
| 1 1 2 |
-----------------------------
| 2 1 3 |
------+---------------+------
T | 3 2 5 | 5
------+---------------+------
| 2 5 1 |
-----------------------------
| 1 2 1 |
------+---------------+------
T | 3 7 2 | 7
------+---------------+------
G | 6 9 7 | 9
-----------------------------
Whenever I try something with the Max() function, I get an error like The expression of [...] uses an aggregate function on a report item. Aggregate functions can be used only on report items contained in the headers and footers..
In MS Excel, I would simply do MAX(A1:C1) in column Max. Is there any solution to achieve this in rdlc ?
I have search the above error and found this answer, but first option is not possible and second option.. well, I did not really understand it, and I do not think it is applicable for Max. If it is, could you explain where I should place the workaround ?
I'm working with Visual Studio 2015 and Microsoft.ReportViewer.WebForms v10.0.0.0.
it needs to put this code in the field "Max" of the rows "T" and "G".. it should work.. I haven't tryed ;)
If Sum(Fields!A.Value) >= Sum(Fields!B.Value) And Sum(Fields!A.Value) >= Sum(Fields!C.Value) Then
Sum(Fields!A.Value)
Else if Sum(Fields!B.Value) >= Sum(Fields!A.Value) And Sum(Fields!B.Value) >= Sum(Fields!C.Value) Then
Sum(Fields!B.Value)
Else
Sum(Fields!C.Value)
End If
update after the comment of KevinM
IIf (
Sum(Fields!A.Value) >= Sum(Fields!B.Value) And Sum(Fields!A.Value) >= Sum(Fields!C.Value)
, Sum(Fields!A.Value)
, (
IIf (Sum(Fields!B.Value) >= Sum(Fields!A.Value) And Sum(Fields!B.Value) >= Sum(Fields!C.Value)
, Sum(Fields!B.Value)
, Sum(Fields!C.Value)
)
)