I need the messages in Azure AppInsights grouped by the existence of particular substrings in the messages and the counts of these messages.
At the end, here is what the grouping would look like
messages count
-------- -------
foomessages <say, 300>
barmessages <say, 450>
:
:
where
foomessages = All messages containing the substring "foo" etc.
How can I construct a query for this ?
datatable(log: string) [
"hello world",
"this is a test",
"this is a world test",
"another test"
]
| summarize
LogsWithWorld = countif(log has "world"),
LogsWithTest = countif(log has "test")
| project Result = pack_all()
| mv-expand Result
| extend Message = tostring(bag_keys(Result)[0])
| extend Count = tolong(Result[Message])
| project Message, Count
The produced result is:
| Message | Count |
|---------------|-------|
| LogsWithWorld | 2 |
| LogsWithTest | 3 |
|---------------|-------|
Related
I am trying to parse the below data in Kusto. Need help.
[[ObjectCount][LinkCount][DurationInUs]]
[ChangeEnumeration][[88][9][346194]]
[ModifyTargetInLive][[3][6][595903]]
Need generic implementation without any hardcoding.
ideally - you'd be able to change the component that produces source data in that format to use a standard format (e.g. CSV, Json, etc.) instead.
The following could work, but you should consider it very inefficient
let T = datatable(s:string)
[
'[[ObjectCount][LinkCount][DurationInUs]]',
'[ChangeEnumeration][[88][9][346194]]',
'[ModifyTargetInLive][[3][6][595903]]',
];
let keys = toscalar(
T
| where s startswith "[["
| take 1
| project extract_all(#'\[([^\[\]]+)\]', s)
);
T
| where s !startswith "[["
| project values = extract_all(#'\[([^\[\]]+)\]', s)
| mv-apply with_itemindex = i keys on (
extend Category = tostring(values[0]), p = pack(tostring(keys[i]), values[i + 1])
| summarize b = make_bag(p) by Category
)
| project-away values
| evaluate bag_unpack(b)
--->
| Category | ObjectCount | LinkCount | DurationInUs |
|--------------------|-------------|-----------|--------------|
| ChangeEnumeration | 88 | 9 | 346194 |
| ModifyTargetInLive | 3 | 6 | 595903 |
I'm looking to get the count of query param usage from the query string from page views stored in app insights using KQL. My query currently looks like:
pageViews
| project parsed=parseurl(url)
| project keys=bag_keys(parsed["Query Parameters"])
and the results look like
with each row looking like
I'm looking to get the count of each value in the list when it is contained in the url in order to anwser the question "How many times does page appear in the querystring". So the results might look like:
Page | From | ...
1000 | 67 | ...
Thanks in advance
you could try something along the following lines:
datatable(url:string)
[
"https://a.b.c/d?p1=hello&p2=world",
"https://a.b.c/d?p2=world&p3=foo&p4=bar"
]
| project parsed = parseurl(url)
| project keys = bag_keys(parsed["Query Parameters"])
| mv-expand key = ['keys'] to typeof(string)
| summarize count() by key
which returns:
| key | count_ |
|-----|--------|
| p1 | 1 |
| p2 | 2 |
| p3 | 1 |
| p4 | 1 |
I have a dataset called Messages that contains C# errors. I have a 2nd dataset called Usernames that contains a list of usernames. I want to remove occurrences of any username from messages. No message should have more then 1 occurance of username. I thought I could do this with gsubfn, but it output all NULLs. Can someone set me straight on the best way to do this?
usrNm <- c(dataset2$username)
stripUsername <- function(x) {gsubfn(usrNm,'',x)}
noUsernames <- within(dataset,{Message=stripUsername(dataset$Message)})
+----------------------------------+----------------------------------+ +--------------+
| Message | Expected output | | Username |
+----------------------------------+----------------------------------+ +--------------+
| User: Mary.Jane sent bad data | User: sent bad data | | Mary.Jane |
+----------------------------------+----------------------------------+ +--------------+
| Error occurred in System.Module. | Error occurred in System.Module. | | Robert.Frost |
+----------------------------------+----------------------------------+ +--------------+
| Hello, world! | Hello, world! | | BB.Wolf |
+----------------------------------+----------------------------------+ +--------------+
| Tracing request by Robert.Frost! | Tracing request by ! |
+----------------------------------+----------------------------------+
Here is one way:
library(stringi)
stri_replace_all_fixed(dataset$Message, dataset2$Username, '', vectorize_all = FALSE)
Output
[1] "User: sent bad data" "Error occurred in System.Module."
[3] "Hello, world!" "Tracing request by !"
Data
dataset <- data.frame(
Message = c("User: Mary.Jane sent bad data", "Error occurred in System.Module.", "Hello, world!", "Tracing request by Robert.Frost!"),
stringsAsFactors = FALSE
)
dataset2 <- data.frame(
Username = c("Mary.Jane", "Robert.Frost", "BB.Wolf")
)
I have following query:
traces
| where customDimensions.Category == "Function"
| where isnotempty(customDimensions.prop__recordId) or isnotempty(customDimensions.prop__Entity)
| project operation_Id, Entity = customDimensions.prop__Entity, recordName = customDimensions.prop__recordName, recordId = customDimensions.prop__recordId
I get results like these:
I want to merge rows by operation_id, and get results like these:
Please try use join operator, like below:
traces
| where customDimensions.Category == "Function"
| where isnotempty(customDimensions.prop__recordId)
| project operation_Id, customDimensions.prop__recordId
| join kind = inner(
traces
| where customDimensions.Category == "Function"
| where isnotempty(customDimensions.prop__Entity)
| project operation_Id,customDimensions.prop__Entity,customDimensions.prop__recordName
) on operation_Id
| project-away operation_Id1 //remove the redundant column,note that it's operation_Id1
| project operation_Id, Entity = customDimensions.prop__Entity, recordName = customDimensions.prop__recordName, recordId = customDimensions.prop__recordId
I did not has the same data, but make some similar data, works fine at my side.
Before merge:
After merge:(and note that use project-away to remove the redundant column which is used as joined key, and it always has number suffix 1 by default)
Final query is:
| where customDimensions.Category == "Function"
| where isnotempty(customDimensions.prop__recordId)
| project operation_Id, customDimensions.prop__recordId
| join kind = inner(
traces
| where customDimensions.Category == "Function"
| where isnotempty(customDimensions.prop__Entity)
| project operation_Id,customDimensions.prop__Entity
) on operation_Id
| join kind = inner(
traces
| where customDimensions.Category == "Function"
| where isnotempty(customDimensions.prop__recordName)
| project operation_Id,customDimensions.prop__recordName
) on operation_Id
| project operation_Id, Entity = customDimensions_prop__Entity, recordName = customDimensions_prop__recordName, recordId = customDimensions_prop__recordId
Angular NormalizedCollection is now working when reference of 'bookings.reservationFor.apartmentId' is passed. It was working perfect when I created a sample firebase entry and defined apartmentId as a value of 'reservationFor' directly and passed 'bookings.reservationFor' in select() parameter.
I am new to angularFire. Please let me know what is wrong with this code.
Using Firebase v2.2.9; AngularJs v1.5.6; AngularFire v1.2.0;
firebase structure
FB
|
--apartment
| |
| --apartment1
| |
| --name: "test name"
| --address: "test address"
| --apartment2
| |
| --name: "test name"
| --address: "test address"
|
--booking
|
--"-JFZG3coHOAblHZ7XSjK"
| |
| --date: "booking date 1"
| --reservatonFor:
|
--apartmentId: "apartment1"
|
--"-KJKJASDIUOPIWE9WEeJ"
| |
| --date: "booking date 2"
| --reservatonFor:
|
--apartmentId: "apartment2"
|
--"-YtUTRGJLNL876F3SSwS"
| |
| --date: "booking date 3"
| --reservatonFor:
|
--apartmentId: "apartment1"
|
Controller
function mainCtrlFunc($scope, $firebaseArray) {
var baseRef = new Firebase(firebaseUrl);
var norm = new Firebase.util.NormalizedCollection(
[baseRef.child("booking"), "bookings"]
[baseRef.child("apartment"), "apartments", "bookings.reservationFor.apartmentId"]
).select(
"bookings.date",
"apartments.name"
)ref();
$scope.bookings = $firebaseArray(norm);
}
Error:
Firebase.child failed: First argument was an invalid path: "[object Object]". Paths must be non-empty strings and can't contain ".", "#", "$", "[", or "]"