Using App Insights how can I write a query that shows me the azure functions that have no been executed in the last 6o days
I came up with the following but it only shows me the ones that were executed more than 60 days ago, it does not tell me if they were excuted in the last 60 days, I am trying to find the ones who have not been executed in the last 60 days so I can flag them for removal
requests
| project timestamp, operation_Name, success, resultCode, duration, cloud_RoleName
//| where timestamp > ago(30d)
| where cloud_RoleName startswith "slapi-prd"
| where success == "True"
| where timestamp < ago(60d)
| order by timestamp desc
| take 20
If you just want to know the latest execution time per function, please use the code below:
requests
//please uncomment the following lines if you need them
//| where timestamp > ago(30d)
//| where cloud_RoleName startswith "slapi-prd"
//| where success == "True"
| summarize timestamp = max(timestamp) by name, cloud_RoleName
Here is the test result:
Related
I would like to accumulate values by timestamp in a ever growing manner.
The following query
ContainerLog
| extend logsize = string_size(LogEntry)
| summarize sum(logsize) by bin(TimeGenerated, 1m)
| render timechart
generates a graph that goes up and down:
I would like to add the previous value with the current value, this way generating an always growing graph symbolizing the total amount of requests up to that moment.
// Sample data generation. Not part of the solution.
let ContainerLog = materialize(range i from 1 to 15 step 1 | extend TimeGenerated = ago(7d*rand()), logsize = rand(1000));
// Solution starts here.
ContainerLog
| summarize sum(logsize) by bin(TimeGenerated, 1m)
| order by TimeGenerated asc
| extend accumulated_sum_logsize = row_cumsum(sum_logsize)
| render timechart
Fiddle
P.S.
I kept sum_logsize for learning purposes.
In your scenario it can be removed.
I am newer to KQL and I am trying to write a query against configuration changes made to files with an extension of ".config" and would like to remove results that are generated under the "TimeGenerated [UTC]" column. The results should exclude Thursday's from midnight- 2am EST. Understanding that TimeGenerated is in UTC, the query should be offsetting that to return EST.
Would someone be able to assist me in writing this? Not sure how to write it up as to have it return the results that exclude the specific time frame. Below is what I have so far:
ConfigurationChange
| where dayofweek(datetime_add('hour', -5, TimeGenerated)) != 4d and hourofday(datetime_add('hour', -5, TimeGenerated)) !in(0, 1) // <---
| where ConfigChangeType in ("Files")
| where FileSystemPath endswith ".config"
| sort by TimeGenerated
| render table
Replace 4d with 4, because dayofweek() returns the number of day (between 0 and 6).
I am newer to KQL and I am trying to write a query against configuration changes made to files with an extension of ".config" and would like to remove results that are generated under the "TimeGenerated [UTC]" column. The results should exclude Thursday's from midnight- 2am EST. Would someone be able to assist me in writing this? Not sure how to write it up as to have it return the results that exclude the specific time frame. Below is what I have so far:
ConfigurationChange
| where ConfigChangeType in("Files")
| where FileSystemPath contains ".config"
| sort by TimeGenerated
| render table
Try adding the following filter, using dayofweek() and hourofday().
Note: The example below works in UTC. You can add the current offset of UTC -> EST to TimeGenerated as part of the filter
ConfigurationChange
| where dayofweek(TimeGenerated) != 6d and hourofday(TimeGenerated) !in(0, 1) // <---
| where ConfigChangeType in ("Files")
| where FileSystemPath contains ".config"
| sort by TimeGenerated
| render table
Timechart x-axis time is printed in UTC-2h, while it should be printed in UTC. Other chars, such us Columnchart, work fine (time is shown in UTC).
Is this an issue?
Is it possible to format time in charts? For instance, printing x-axis time in local time...
Timechart column in Azure Data Explorer is stored in UTC (Local time -2h in my location).
When printing a columnchart, time in X-axis is printed in UTC (local time -2h) -> OK
columnchart output
When printing a timechart, time in x-axis is printed in UTC-2h (local time-4)-> KO
timechartoutput
Azure Data Explorer query:
let min_t = toscalar (<tablename> | summarize min(Timestamp));
let max_t = toscalar (<tablename> | summarize max(Timestamp));
<tablename>
| make-series sum(TrxCount) on Timestamp in range(min_t, max_t, 30m )
| render columnchart
This is indeed a bug.
It happens specifically after make-series so doing something like
<tablename> | summarize sum(TrxCount) by bin(Timestamp, 30m) | render timechart
should work (although it won't fill empty data like make-series does.
I come from a php/mysql background, and json data and firebase queries are still pretty new to me. Now I am working in React Native and I have a collection of data, and one of the keys stores a integer. I want to get the average of all the integers. Where do I even start?
I have used Firebases snapshot.numChildren function before so I am getting a little more familiar in this json world, but any sort of help would be appreciated. Thanks!
So, you know that you can return all of the data and determine the average. I'm guessing this is for a large set of data where it would be ideal not to return the entire node every time you would like to retrieve and average.
It depends on what this data is and how it's being updated, but I think one option is to simply have a separate node that is updated every time the collection is added to or is changed.
Here is some really rough pseudo code. For example, if your database looks like this:
database
|
+--collection
| |
| +--item_one (probably a uid like -k2jduwi5j5j5)
| | |
| | +--number: 90
| |
| +--item_two
| | |
| | +--number: 70
|
+--collection_metadata
| |
| +--average: 80
| |
| +--number_of_items: 2
Then when a new item is added, you run a metadata calculation:
var numerator = average * number_of_items + newItem.number;
number_of_items++; <-- this is your new number of items
numerator / number_of_items; <-- this is your new average
Then when an item is updated, you run a metadata calculation:
var numerator = average * number_of_items - changedItem.oldNumber + changedItem.newNumber;
numerator / number_of_items; <-- this is your new average
Now when you want this data, you always have this data on hand.