I have two queries: both have similar results. I just want to draw both on one time chart in azure log analytics.
customEvents
| where name startswith "USER_LOGIN"
| extend responseTime_in_sec = todouble(customMeasurements.responseTime)/1000
| summarize avg(responseTime_in_sec) by responseTime_in_sec, bin(timestamp, 1h)
| render timechart
customEvents
| where name startswith "DEPENDENT_SERVICE"
| extend responseTime_in_sec = todouble(customMeasurements.responseTime)/1000
| summarize avg(responseTime_in_sec) by responseTime_in_sec, bin(timestamp, 1h)
| render timechart
As discussed in the comments, sometimes the solution can be quite easy :)
customEvents
| where name startswith "DEPENDENT_SERVICE" or name startswith "USER_LOGIN"
| extend responseTime_in_sec = todouble(customMeasurements.responseTime)/1000
| summarize avg(responseTime_in_sec) by name, responseTime_in_sec, bin(timestamp, 1h)
| render timechart
If the query is more complex than this, often the union operator can help as welll.
Related
I have a query that fetches the number of unique vulnerabilities found in our images in our Azure Container Registry:
securityresources
| where type == 'microsoft.security/assessments/subassessments'
| where id matches regex '(.+?)/providers/Microsoft.Security/assessments/dbd0cb49-b563-45e7-9724-889e799fa648/'
| parse id with registryResourceId '/providers/Microsoft.Security/assessments/' *
| parse registryResourceId with * "/providers/Microsoft.ContainerRegistry/registries/" registryName
| extend imageDigest = tostring(properties.additionalData.imageDigest), repository = tostring(properties.additionalData.repositoryName)
| project
registryName,
repository,
imageDigest,
severity = properties.status.severity,
vulnId = properties.id,
displayName = properties.displayName,
description = properties.description,
remediation = properties.remediation,
category = properties.category,
impact = properties.impact,
timeGenerated = properties.timeGenerated
| distinct tostring(vulnId)
| summarize count()
I would like to have a graph that shows the number of vulnerabilities over a period of time so we can see (visually) that the number of vulnerabilities are going down (or up), but I have no clue on how to do this. Hopefully someone can help me in achieving this.
instead of distinct tostring(vulnId) | summarize count(), try either of the following:
summarize dcount() by bin(timeGenerated, 1h)
make-series dcount() on timeGenerated step 1h
and then add a | render timechart at the end
e.g:
securityresources
| where type == 'microsoft.security/assessments/subassessments'
| where id matches regex '(.+?)/providers/Microsoft.Security/assessments/dbd0cb49-b563-5e7-9724-889e799fa648/'
| extend vulnId = tostring(properties.id)
| summarize dcount(vulnId) by bin(timeGenerated, 1h)
| render timechart
I'm trying to query some Azure Application Gateway related things from Azure Log Analytics.
I get for a query like this results for every single http status code:
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.NETWORK" and Category == "ApplicationGatewayAccessLog"
| summarize count() by httpStatus_d, Resource
Now I need those results grouped for 2xx, 3xx, 4xx and 5xx.
New to Kusto I don't find the right approach to achieve this.
Thanks for your hints!
you could try using the bin() function, e.g.:
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.NETWORK" and Category == "ApplicationGatewayAccessLog"
| summarize count() by bin(httpStatus_d, 100), Resource
Thanks to #yoni who sent me into the right direction.
I solved this like this:
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.NETWORK" and Category == "ApplicationGatewayAccessLog"
| extend HTTPStatus = case(httpStatus_d between (200 .. 299), "2XX",
httpStatus_d between (300 .. 399), "3XX",
httpStatus_d between (400 .. 499), "4XX",
"5XX")
| summarize count() by HTTPStatus, bin(timeStamp_t, 1h)
| render timechart
Group by all httpStatus_d values automatically.
AzureDiagnostics
| where TimeGenerated > ago(30d)
| summarize count=count() by httpStatus_d
| order by httpStatus_d asc
We are having some trouble using the time charts in Azure Kusto.
In this chart we have grouped http exceptions over time.
The issue is that the chart still reports the last seen value for points in time where that exception does not exist.
See red markings.
In this specific case we see that the chart reports 3.23k exceptions on the /poll endpoint at 5:28. while there are in fact no such error at that time.
The query looks like this
AppServiceHTTPLogs
| where TimeGenerated > ago(1d)
| where ScStatus >= 500
| summarize count() by tostring(CsUriStem), bin(TimeGenerated, 30m)
| render timechart
Using a column chart makes the issue go away, but this comes with the price of being much less clear.
Are there any other options?
Can we somehow make missing values default to 0 instead?
You should be able to fill with default zeros using make-series operator:
https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/make-seriesoperator
AppServiceHTTPLogs
| where TimeGenerated > ago(1d)
| where ScStatus >= 500
| make-series count() on TimeGenerated from ago(1d) to now() step 30min by tostring(CsUriStem)
| render timechart
Some UX clients do not know how to represent series data - and in this case you can expand it using mv-expand:
AppServiceHTTPLogs
| where TimeGenerated > ago(1d)
| where ScStatus >= 500
| make-series count() on TimeGenerated from ago(1d) to now() step 30min by tostring(CsUriStem)
| mv-expand count_ to typeof(long)
| render timechart
In the Azure new log analytics query platform you can query for performance counters and summarize them to finally create a nice graph.
Following the multiple dimensions documentation example it says
Multiple expressions in the by clause creates multiple rows, one for
each combination of values.
I want to query their sample database for networks bytes Send and Received per each computer. Starting with this query it should be something like
Perf
| where TimeGenerated > ago(1d)
| where (CounterName == "Bytes Received/sec" or CounterName == "Bytes Sent/sec")
| summarize avg(CounterValue) by bin(TimeGenerated, 1h), Computer, CounterName
| extend Threshold = 20
| render timechart
The problem is that Send and Received bytes gets grouped in the graph at computer level.
How can multiple dimensions be represented as stated in the documentation so that I have Computer X Bytes Send and Computer X Bytes Received instead of them grouped together witch doesn't make any sense?
Not to mention that in the previous version this was working as expected.
I though that if multiple dimensions are not really accepted a string concatenation would do the trick. A bit hackish in my opinion but it did.
Perf
| where (CounterName == "Bytes Received/sec" or CounterName == "Bytes Sent/sec") and InstanceName matches regex "^Microsoft Hyper-V Network Adapter.*$"
| summarize avg(CounterValue) by strcat(Computer, " ", CounterName), bin(TimeGenerated, 10s)
| render timechart
Another option is this
let RuntimeID = CosmosThroughput_CL
| where MetricName_s == "ProvisionedThroughput" and TimeGenerated between (ago(2h) .. ago(1h))
| order by TimeGenerated desc
| top 1 by TimeGenerated
| distinct RuntimeID_g;
CosmosThroughput_CL
| where MetricName_s == "ProvisionedThroughput" and RuntimeID_g in (RuntimeID)
| project Resource = toupper(Resource), Value = Throughput_d, Container = Container_s, Database = Database_s, MetricName = "Provisioned"
| union
(
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.DOCUMENTDB" and Category == "PartitionKeyRUConsumption"
| where TimeGenerated between (ago(1d) .. ago(1d-1h))
| summarize Value = sum(todouble(requestCharge_s)) by Resource, databaseName_s, collectionName_s
| project Resource, Container = collectionName_s, Database = databaseName_s, Value, MetricName = "HourlyUsage"
)
| union
(
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.DOCUMENTDB" and Category == "PartitionKeyRUConsumption"
| where TimeGenerated between (ago(1d) .. ago(1d-1h))
| summarize Value = sum(todouble(requestCharge_s)/3600) by Resource, databaseName_s, collectionName_s
| project Resource, Container = collectionName_s, Database = databaseName_s, Value, MetricName = "RUs"
)
| project Resource, Database, Container, Value, MetricName
The important part is to project the same column names. Value holds the different values from each table. Second union helps me project another value from the same table.
I'd like to do,
Extracting "query" strings where param=1 as follows in "2."
Getting pageViews in Analytics with table as "3."
1. Actual urls included in pageView
https://example.com/dir01/?query=apple¶m=1
https://example.com/dir01/?query=apple¶m=1
https://example.com/dir01/?query=lemon+juice¶m=1
https://example.com/dir01/?query=lemon+juice¶m=0
https://example.com/dir01/?query=tasteful+grape+wine¶m=1
2. Value expected to extract
apple
lemon+juice
tasteful+grape+wine
3. Expected output in AI Analytics
Query Parameters | Count
apple | 2
lemon+juice | 1
tasteful+grape+wine | 1
Tried to do
https://learn.microsoft.com/en-us/azure/application-insights/app-insights-analytics-reference#parseurl
https://aka.ms/AIAnalyticsDemo
I think extract or parseurl(url) should be useful. I tried the latter parseurl(url) but don't know how to extract "Query Parameters" as one column.
pageViews
| where timestamp > ago(1d)
| extend parsed_url=parseurl(url)
| summarize count() by tostring(parsed_url)
| render barchart
url
http://aiconnect2.cloudapp.net/FabrikamProd/
parsed_url
{"Scheme":"http","Host":"aiconnect2.cloudapp.net","Port":"","Path":"/FabrikamProd/","Username":"","Password":"","Query Parameters":{},"Fragment":""}
Yes, parseurl is the way to do it. It results in a dynamic value which you can use as a json.
To get the "query" value of the query parameters:
pageViews
| where timestamp > ago(1d)
| extend parsed_url=parseurl(url)
| extend query = tostring(parsed_url["Query Parameters"]["query"])
and to summarize by the param value:
pageViews
| where timestamp > ago(1d)
| extend parsed_url=parseurl(url)
| extend query = tostring(parsed_url["Query Parameters"]["query"])
| extend param = toint(parsed["Query Parameters"]["param"])
| summarize sum(param) by query
You can see how it works on your example values in the demo portal:
let vals = datatable(url:string)["https://example.com/dir01/?
query=apple¶m=1", "https://example.com/dir01/?query=apple¶m=1",
"https://example.com/dir01/?query=lemon+juice¶m=1",
"https://example.com/dir01/?query=lemon+juice¶m=0",
"https://example.com/dir01/?query=tasteful+grape+wine¶m=1"];
vals
| extend parsed = parseurl(url)
| extend query = tostring(parsed["Query Parameters"]["query"])
| extend param = toint(parsed["Query Parameters"]["param"])
| summarize sum(param) by query
Hope this helps,
Asaf