The error I got is "The Line can't be created as you are missing a column of one of the following types: int, long, decimal, or real"

this is my query" I am looking the chart will display "number of unique resource IDs over time, with an aggregation timespan of 5m"

syslog_CL
 | where data_s contains "Reject" 
 | where hostname_s contains "Network1"
 | where TimeGenerated > ago(1hr)

is there any suggestion I can add to the query to get the time chart?

CodePudding user response：

you could try something like this:

syslog_CL
| where data_s contains "Reject" 
| where hostname_s contains "Network1"
| where TimeGenerated > ago(1hr)
| summarize dcount(_ResourceId) by bin(TimeGenerated, 5m)
| render timechart