I am trying to create a requests per minute time (RPM) chart in Azure Monitor workbook for requests which are throttled and non-throttle in the form of two lines (overlayed). I manage to create a time chart for RPM with one line but what is the best way to show two distinct lines for each type of request.
Here is the KQL for the chart. Thinking to perform self-join on the table (T) based on ResultType (Throttled and Non-Throttled) but not sure about it. Maybe a better solution out there.
let T = datatable(Timestamp:datetime, ResultType:string, ResultSignature:string, CorrelationId:string) [
"2022-03-02T14:25:21.8262878Z", "Throttled", "200", "be8bd024-8f5c-4a01-9703-2945ef3bc8ba",
"2022-03-02T14:25:35.3729584Z", "Throttled", "200", "66ed2194-ffa2-43ae-96f4-d3d8d1fb4c4d",
"2022-03-02T14:25:35.5681385Z", "Throttled", "200", "37b33938-0498-4e66-b16e-8c77ac9cf6b9",
"2022-03-02T14:25:35.9571988Z", "Throttled", "200", "cc9a0638-37b2-4c25-8578-8df206896de0",
"2022-03-02T14:25:38.1975426Z", "Throttled", "200", "2b70359d-1732-4cfe-8eda-ef993bbd638a",
"2022-03-02T14:25:38.3044257Z", "Throttled", "200", "9143b5fc-c074-467a-bb97-9765e698e3ff",
"2022-03-02T14:25:40.0240219Z", "Throttled", "200", "8cd18445-556e-44fe-81d8-38e261fddb02",
"2022-03-02T14:25:48.3866310Z", "Throttled", "200", "c5d21533-e1cd-484a-aee2-d05b804eecf0",
"2022-03-02T14:26:03.2572998Z", "Throttled", "200", "46c47f34-2402-45e1-ba8b-fea4d2e59640",
"2022-03-02T14:28:23.1553098Z", "Non-Throttled", "302", "fa309b65-b0b7-43d3-b3aa-9b6de6ce17cb",
"2022-03-02T14:28:23.9385460Z", "Non-Throttled", "200", "daedb13f-8b3e-4268-9803-b3bf8039d776",
];
T
| project Timestamp, ResultType, ResultSignature , CorrelationId
| summarize TotalRequests = count() by bin(Timestamp,1m)
CodePudding user response:
you can add ResultType
as an aggregation key.
i.e. you can replace this:
| summarize TotalRequests = count() by bin(Timestamp,1m)
with this:
| summarize TotalRequests = count() by ResultType, bin(Timestamp,1m)