I have a data set in Kusto and I would like to gather the ids from each day where their latency is greater than the 99th percentile for that day.

e.g I have a table like this:

and I want the result table to just be

where a and b come from the 99th percentile of latency times for those days

What I would like to work:

let 99p= T
| summarize percentiles(latency, 99) by bin(time, 1d);
T
| where startofday(time) == 99p.time
| where latency > 99p.latency
| project time, id

Thanks for any insight, pretty new to kusto

CodePudding user response：

// This is not a part of the solution, only generation of a sample data set
let T = materialize (range id from 1 to 1000 step 1 | extend ['time'] = ago(rand()*10d), latency = round(rand()*100,2));
// The solution starts here
T | extend day = bin(['time'], 1d) | as T2
| summarize percentiles(latency, 99) by day
| join kind=inner T2 on day 
| where latency >= percentile_latency_99
| summarize make_list(id) by day

Fiddle