Looking for Kusto Query Language to query an endpoint for response time from the API-CodePudding

This is my current query that i have in azure logs:

let numberOfBuckets = 24;
let interval = toscalar(requests | where url matches regex "courses.*"
| summarize interval = (max(timestamp)-min(timestamp)) / numberOfBuckets
| project floor(interval, 1m));
requests | where url matches regex "courses.*"
| summarize count() by url

It doesn't quite work and I've tried a lot of different ways to do this

like this...

let under400_course = requests | where url matches regex "/courses.*" | where duration < 400 | count; 
let total_req_course = requests | where url matches regex "/courses.*" | count; 
print under400_apt_SLI = toscalar(under400_course) * 100/toscalar(total_req_course);

just as a query to get information...

how do I actually get each response time for every connection in the last 24 hours for this endpoint?

CodePudding user response：

how do I actually get each response time for every connection in the last 24 hours for this endpoint?

I think the query is simpler for this request. Have you tried this?

requests
| where timestamp > ago(24h)
| where url matches regex "courses.*"
| project timestamp, url, resultCode, duration

The query timestamp > ago(24h) will filter all requests in the last 24 hours. And the response time for request is already presented in requests table.

You can refer to Kusto guideline by MS here: https://docs.microsoft.com/en-us/azure/data-explorer/kusto/query/

CodePudding user response：

let fastResponseTimeMaxMs = 800;
let errorBudgetThresholdForFastResponseTime = 90.0;
//
let startTime = ago(7days);
let endTime = now();
let timeStep = 300m;
//
requests
| where timestamp > startTime and timestamp < endTime
| where success == 'True' | where url matches regex "<URL>.*" 
| summarize TotalCount = count(), ActualCount = countif(duration <= fastResponseTimeMaxMs) by bin(timestamp, timeStep)
| extend Percentage = round(todecimal(ActualCount * 100) / todecimal(TotalCount), 2)
| extend ErrorBudgetMinPercent = errorBudgetThresholdForFastResponseTime
| extend InBudget = case(Percentage >= ErrorBudgetMinPercent, 1, 0)

This works... took a bit but I got it!