We have 2 customlogs in loganalytics out of that I am able to get avg of each one and I need to merge those 2 and make it as 1 means avg of vpn+url
workspace(name).vpn_CL
| extend healty=iff(Status_s == 'Connected' , 100 , 0)
| summarize vpn = avg(healty) by EnvName_s, ClientName_s
|
join
(
workspace(name).url_CL
| extend Availability=iff(StatusDescription_s == 'OK' , 100 , 0)
| summarize URL=avg(Availability) by EnvName_s, ClientName_s
) on ClientName_s
| project Client=ClientName_s, Environment=EnvName_s , vpn , URL
Based on my understanding, I think the value of the average of vpn+url is the result of plus vpn value with url value when the number of healty entites is equals to the number of Availability entites.
Otherwise, if their entites quantity are not equal, the average of the two labels is a expected value based on their probabilities,
Then,
workspace(name).vpn_CL
| extend healty=iff(Status_s == 'Connected' , 100 , 0)
| summarize m = count(), vpn = avg(healty) by EnvName_s, ClientName_s
|
join
(
workspace(name).url_CL
| extend Availability=iff(StatusDescription_s == 'OK' , 100 , 0)
| summarize n = count(), URL=avg(Availability) by EnvName_s, ClientName_s
) on ClientName_s
| project Client=ClientName_s, Environment=EnvName_s , vpn , URL, avgOfVpnUrl = vpn*m/(m+n)+url*n/(m+n)
Hope it helps.
Related
I am trying to create an alert for throttled message in eventhub. And the query i am using is:
AzureMetrics
| where TimeGenerated > ago(30m)
| where MetricName == "OutgoingMessages" or MetricName == "IncomingMessages"
| extend Total_Outgoing_Messages = iif(MetricName == "OutgoingMessages", Total, 0.00)
| extend Total_Incoming_Messages = iif(MetricName == "IncomingMessages", Total, 0.00)
| summarize sum(Total_Outgoing_Messages), sum(Total_Incoming_Messages) by TimeGenerated
| extend Throttled_messages = abs(sum_Total_Incoming_Messages - sum_Total_Outgoing_Messages)
| extend condition = Throttled_messages > 10 and Throttled_messages < 25
I am trying to create an alert which should be fired when throttled message is between > 10 and < 25. My condition column is giving me either true or false
Could someone please check my kql? whether i am heading to right direction or not
Thanks
by TimeGenerated doesn't seem to make sense.
Either use bin, e.g. by bin(TimeGenerated, 5m), or remove it completely, dependent on your alert logic.
a Syntax comment -
No need for extend ... iif(...) ... as a preparation for the summarize sum(...).
You can simply use sumif()
I have the following data :
val df = Seq(("Central" , "Copy Paper" , "Benjamin Ross" , "$15.58" , "$3.91" , "126"),
| ("East" , "Copy Paper" , "Catherine Rose" , "$12.21" , "$0.08" ,"412"),
| ("West" ,"Copy Paper" , "Patrick O'Brill" , "$2,756.66" , "$1,629.98" ,"490"),
| ("Central" , "Business Envelopes" , "John Britto" , "$212.74" , "$109.66" , "745"),
| ("East" , "Business Envelopes" , "xyz" , "$621" , "$721" ,"812")).toDF("Region" , "Product" , "Customer" , "Sales", "Cost" , "Autonumber")
df.show()
+-------+------------------+---------------+---------+---------+----------+
| Region| Product| Customer| Sales| Cost|Autonumber|
+-------+------------------+---------------+---------+---------+----------+
|Central| Copy Paper| Benjamin Ross| $15.58| $3.91| 126|
| East| Copy Paper| Catherine Rose| $12.21| $0.08| 412|
| West| Copy Paper|Patrick O'Brill|$2,756.66|$1,629.98| 490|
|Central|Business Envelopes| John Britto| $212.74| $109.66| 745|
| East|Business Envelopes| xyz| $621| $721| 812|
+-------+------------------+---------------+---------+---------+----------+
You can see that For Business Envelopes product , there is no data with regard to West. If there was data for West , the result would not have been null. Since there is no data pivoting with region resulted in null values which I want it to be 0 , so it can be subtracted from the first(sum(Autonumber)) and a value can be obtained. Instead now it returns a null. If in some way I can get data for Central in the group by query , things would be much simpler.
I tried the following query :
spark.sql("SELECT * FROM (SELECT region r, product as p, SUM(Autonumber) - first(sum(Autonumber)) over ( partition by product order by product , region) as new from test1 group by r , p order by p,r) test1 pivot (sum(new) for r in ('Central' Central , 'East' East, 'West' West))").show
This was the data that I got
+------------------+-------+-----+-----+
| p|Central| East| West|
+------------------+-------+-----+-----+
|Business Envelopes| 0.0| 67.0| null|
| Copy Paper| 0.0|286.0|364.0|
+------------------+-------+-----+-----+
Where I expected it to be this way..
+------------------+-------+-----+------+
| p|Central| East| West|
+------------------+-------+-----+------+
|Business Envelopes| | 67.0|-745.0|
| Copy Paper| |286.0| 364.0|
+------------------+-------+-----+------+
This is nothing but pivot on region with sum(autonumber) and then subtracting from the first value.
Any suggestions on what can be done to get -745 instead of null ?
I suppose that's not possible with this way.
Instead I pivoted the dataset and then subtracted from the first value.
spark.sql("select p , coalesce(Central , 0) - null as Central , coalesce(East,0) - coalesce(central,0) as East , coalesce(West , 0) - coalesce(central,0) as West from (SELECT * FROM (SELECT region r, product as p, SUM(Autonumber) as new from test group by r , p order by p) test pivot (sum(new) for r in ('Central' Central ,'East' East, 'West' West)))").show
After setting a cube I was asked to add dynamic security with use of table of users and data they can see.
The problem is that i have to take into account 3 different dimensions.
I've decided to use the fact table with noneEmpty function on count.
NonEmpty([Dimension].[Hierarchy].members,
([Measures].[Allowed Count],
[Users].[User].&[UserName]
)
)
After setting role I've got result like:
Dim1 | Dim2 | Dim3
1 | A | 300
1 | A | 320
1 | A | 340
1 | B | 300
1 | B | 320
1 | B | 340
Where it should be:
Dim1 | Dim2 | Dim3
1 | A | 300
1 | A | 320
1 | B | 340
Data for allowed user access are stored in table like
UserName | Dim1Key | Dim2Key | Dim3Key
Hierarchy is like
Each Dim1 contains each type of Dim2 that contains each type of Dim3.
And user can only access given member of Dim3 in Dim2 in Dim1.
Is there a way to connect this dimensions in MDX so each Dim in the end has only its respective values
UPDATE:
After some research I've got this query:
SELECT [Measures].[CC Count] ON 0,
NonEmpty(
(
NonEmpty((Dim1.children),
([Measures].[CC Count],
[Users].[User].&[userName]
))
,
NonEmpty((Dim2.children),
([Measures].[CC Count],
[Users].[User].&[userName]
)),
NonEmpty((Dim3.children),
([Measures].[CC Count],
[Users].[User].&[userName]
))
)
,([Measures].[CC Count],
[Users].[User].&[userName]
))
ON 1
FROM [Cost Center]
That gives me wanted results, but I can't place it into Dimensiom Data in Role. Is there a way to change it?
Please try creating a new hidden dimension where the key attribute has a composite key of key1, key2 and key3. You will have to pick some NameColumn but it doesn't matter. So pick key1 as the name. You don't need anything on the dimension except the dimension key.
In the Dimension Usage of your cube designer make sure this new dimension is joined to all fact tables and to the security measure group which provided the CC Count measure.
Then create role based security just on that dimension. The users will be able to see all members of all dimensions but this new composite key dimension will ensure they can't see fact rows they are not supposed to. And this should perform much better than the alternative which is cell security.
In this table application will feed us with the below data and it will be incremental as and when we will receive updates on the status . So initially table will look like the below as shown:-
+---------------+---------------+---------------+---------------+
| ID | Total count | Failed count | Success count |
+---------------+---------------+---------------+---------------+
| 1 | 30 | 10 | 20 |
+---------------+---------------+---------------+---------------+
Now let’s assume total 30 messages are pushed now out of which 10 Failed and 20 Success as shown above.Now again application is run and values changed . Now total 20 new records came in out of which all are success. This should be updated in the same row .
+---------------+---------------+---------------+---------------+
| ID | Total count | Failed count | Success count |
+---------------+---------------+---------------+---------------+
| 1 | 50 | 10 | 40 |
+---------------+---------------+---------------+---------------+
Is it feasible in Cassandra DB using Counter data type?
Of course you can use counter tables in your case.
Let's assume table structure like :
CREATE KEYSPACE Test WITH REPLICATION = { 'class' : 'SimpleStrategy', 'replication_factor' : 3 };
CREATE TABLE data (
id int,
data string,
PRIMARY KEY (id)
);
CREATE TABLE counters (
id int,
total_count counter,
failed_count counter,
success_coutn counter,
PRIMARY KEY (id)
);
You can increment counters by running queries like :
UPDATE counters
SET total_count = total_count + 1,
success_count = success_count + 1
WHERE id= 1;
Hope this can help you.
Googling it a bit I found this to be an interesting question. Would like you guys shots.
Having my table
USER | MAP | STARTDAY | ENDDAY
1 | A | 20110101 | 20110105
1 | B | 20110106 | 20110110
2 | A | 20110101 | 20110107
2 | B | 20110105 | 20110110
Whant I want is to fix user's 2 case, where maps A and B overlaps by a couple days (from 20110105 until 20110107).
I wish I was able to query that table in a way that it never return overlapping ranges. My input data is falky already, so I don't have to worry with the conflict treatment, I just want to be able to get a single value for any given BETWEEN these dates.
Possible outputs for the query I'm trying to build would be like
USER | MAP | STARTDAY | ENDDAY
2 | B | 20110108 | 20110110 -- pushed overlapping days ahead..
2 | A | 20110101 | 20110104 -- shrunk overlapping range
It doesn't even matter if the algorithm causes "invalid ranges", e.g. Start = 20110105, End = 20110103, I'll just put null when I get to these cases.
What would you guys say? Any straight forward way to get this done?
Thanks!
f.
Analytic functions could help:
select userid, map
, case when prevend >= startday then prevend+1 else startday end newstart
, endday
from
( select userid, map, startday, endday
, lag(endday) over (partition by userid order by startday) prevend
from mytable
)
order by userid, startday
Gives:
USERID MAP NEWSTART ENDDAY
1 A 01/01/2011 01/05/2011
1 B 01/06/2011 01/10/2011
2 A 01/01/2011 01/07/2011
2 B 01/08/2011 01/10/2011