I'm trying to render the difference between two dates over time in Application Insights Analytics, but timespan isn't a supported type for the y-axis of a timechart.
Example query:
customMetrics
| extend dateDiff = timestamp - (timestamp - 1m)
// my second date comes from customDimensions
| summarize max(dateDiff) by bin(timestamp, 10m)
| order by timestamp desc
| render timechart
I'd like to transform my dateDiff timespan into an integer representing the number of milliseconds but I can't find anything in their documentation that supports this. I basically want C#'s TimeSpan.TotalMilliseconds().
You can divide your timespan by another timespan. So, to get number of milliseconds you can do the following:
customMetrics
| extend dateDiff = timestamp - (timestamp - 1m)
// get total milliseconds
| extend dateDiffMilliseconds = dateDiff / time(1ms)
// my second date comes from customDimensions
| summarize max(dateDiff) by bin(timestamp, 10m)
| order by timestamp desc
| render timechart
More about date and time expressions can be found here: https://learn.microsoft.com/en-us/azure/application-insights/app-insights-analytics-reference#date-and-time-expressions
Related
The following example query works in the Azure Data Explorer UI but not with Kqlmagic in Jupyter Notebook.
%%kql
let min_t = toscalar(demo_make_series1 | summarize min(TimeStamp));
let max_t = toscalar(demo_make_series1 | summarize max(TimeStamp));
demo_make_series1
| make-series num=count() default=0 on TimeStamp in range(min_t, max_t, 1h) by OsVer
| render timechart
It just throws No valid xcolumn. Any idea whats the issue?
Note: The database demo_make_series1 is available on the help cluster from ADX.
This indeed looks like a bug in KqlMagic rendering. We shall check and update. Meanwhile you can use mv-expand before rendering. Regardless, in make-series I suggest you avoid using the deprecated range(...) syntax in favor of 'from ... to ... step ...'. Here is the updated query:
%%kql
let min_t = toscalar(demo_make_series1 | summarize min(TimeStamp));
let max_t = toscalar(demo_make_series1 | summarize max(TimeStamp));
demo_make_series1
| make-series num=count() default=0 on TimeStamp from min_t to max_t step 1h by OsVer
| mv-expand num to typeof(long), TimeStamp to typeof(datetime)
| render timechart
thanks,
Adi
I am trying to convert the below Splunk query to Kusto.
| eval result=if(Match(Status,"Success|Passed"), "succeess","failed")
Below is the example from Kusto that is not clear . How do I modify this Kusto example as per the above Splunk Query pls. Thanks
| extend day = iff(floor(Timestamp, 1d)==floor(now(), 1d), "today", "anotherday")
You could try this:
...
| summarize success = countif(Status in ("Success", "Passed")), total = count()
| project success, failure = total - success
in case the values in the column named Status can have different casing, you can use in~()
in case the values in the column named Status are longer strings, which you want to look for substring in, you can use, for example: Status contains "Success" or Status contains "Passed"
Title says it all - I have App Insights Data that looks like this:
I need a query to go through this data and return to me - ID's 12345 and 09282 - because 09282 starts before 12345 and they are both on the same node.
Any help or pointers would be greatly appreciated.
Please try to use join operator.
Sample code like below(assume the table name is mytable):
let mytablesss = mytable
| where timestamp > ago(7d);
mytablesss
| join kind= inner (
mytable
| where timestamp > ago(7d)
) on cloudRoleInstance
| where StartTime < EndTime1
//if startTime and EndTime are string type, use todatetime(StartTime) and todatetime(EndTime1) in the where clause.
Please feel free to modify the code to meet your need.
Note that: in the 2nd table(mytable), all the fields will be automatically suffix with 1, eg. in the first table, the filed is Endtime; but in the 2nd table, it becomes Endtime1.
I'm trying to get a list of all of the parent posts in my database sorted by the most recent activity to that thread. That means check the most recent post to that thread - if there's children posts then check their most recent date, if not then the parent's date.
I have one table called "posts" that consists of the following:
If a post is a parent (first post of thread): Topic is not null, Parent_ID is null. It would look like this:
ID | Name | Message | Date | File | Topic | Parent_ID
=====================================================
1 | Joe | Wee! | Date | File | Blah! | NULL
If a post is a child (a post in a thread = parent's ID): Topic is null, Parent_ID is not null. It would look like this:
ID | Name | Message | Date | File | Topic | Parent_ID
=====================================================
2 | Mike | Hi! | Date | File | NULL | 1
I've gotten really close. I think it has something to do with the With Clause. This is what I came up with so far:
WITH threads AS (
SELECT ID,Name,Date,File,Topic,Parent_ID FROM posts WHERE Parent_ID IS NULL
UNION ALL
SELECT Parent_ID,Name,Date,File,Topic,Parent_ID FROM posts WHERE Parent_ID NOTNULL ORDER BY Date DESC
)
SELECT * FROM threads GROUP BY ID ORDER BY Threads.date;
I already know I can search for similar questions. I've already tried and still haven't come to an exact conclusion. Any help would be appreciated.
Also, should I change my table up? Maybe add a thread column or even a thread table or something to make things easier?
AllDates is a standard tree walk, and collects all dates for each topic; the TopID is kept through all iterations so that the last date can be associated with it.
LastDates then throws away all rows that are not the last date.
WITH RECURSIVE AllDates(TopID, ID, Date) AS (
SELECT ID, ID, Date
FROM Threads
WHERE Parent_ID IS NULL
UNION ALL
SELECT AllDates.TopID, Threads.ID, Threads.Date
FROM AllDates
JOIN Threads ON AllDates.ID = Threads.Parent_ID
),
LastDates(ID, LastDate) AS (
SELECT TopID, max(Date)
FROM AllDates
GROUP BY TopID
)
SELECT *
FROM Threads
JOIN LastDates USING (ID)
-- WHERE Parent_ID IS NULL (not needed because of the join)
ORDER BY LastDate DESC;
(This would be much easier and faster if each post had a reference to the thread.)
I use this query to display exceptions:
exceptions
| where application_Version == "xyz"
| summarize count_=count(itemCount), impactedUsers=dcount(user_Id) by problemId, type, method, outerMessage, innermostMessage
| order by impactedUsers
How to query what percent of users are impacted by specific exception?
I would check all users by this query:
customEvents
| where application_Version == "xyz"
| summarize dcount(user_Id)
You're almost there with what you have, you just need to connect the two:
use let + toscalar to define the results of a query as a number
reference that in your query (i used *1.0 to force it to be a float, otherwise you get 0, and used round to get 2 decimals, adjust that however you need)
making your query:
let totalUsers = toscalar(customEvents
| where application_Version == "xyz"
| summarize dcount(user_Id));
exceptions
| where application_Version == "xyz"
| summarize count_=count(itemCount),
impactedUsers=dcount(user_Id),
percent=round(dcount(user_Id)*1.0/totalUsers*100.0,2)
by problemId, type, method, outerMessage, innermostMessage
| order by impactedUsers