Best way to show today Vs yesterday Vs week in KQL azure monitror-CodePudding

I am trying to show the count for today 9rolling 24 hours) vs yesterday (again rolling) Vs the weekly average

And though I've got the code to work but I am getting an error as well

The error is (Query succeeded with warnings: There were some errors when processing your query.: "Partial query failure: Unspecified error (message: 'shard: 5eeb9282-0854-4569-a674-10f8daef9f7d, source: (Error { details: Rest(404, "HEAD qh1kustorageoiprdweu16.blob.core.windows.net/jgtb64673c4e98a07fa116b4e49211-0d2a81b5bf3540e087ff2cc0e4e57c98/13da174e-3951-4b54-9a45-1f9cbe5759b4/426a5a10-4e91-4...")

The code

let Yes_End = ago(24h);
let Yes_Start = ago(48h);
let N = ago(1m);
let LW_end = ago(14d);
let Lw_start = ago(7d);

let Curr = customMetrics
|extend Dec_Reasion = tostring(customDimensions["DeclineReason"])
|extend Type = tostring(customDimensions["AcquiringInstitutionId"])
|extend dw = dayofweek(timestamp)
|where name =='TransactionsDeclined'
|where timestamp between (Yes_End..N)
|summarize CurrentVal=sum(valueCount) by tostring(Dec_Reasion);


let Trend = customMetrics
|extend Dec_Reasion = tostring(customDimensions["DeclineReason"])
|extend Type = tostring(customDimensions["AcquiringInstitutionId"])
|where timestamp between (Yes_Start .. Yes_End)
|where name =='TransactionsDeclined'
|summarize Yesterday_total=sum(valueCount) by tostring(Dec_Reasion);

let weekTrend =customMetrics
|extend Dec_Reasion = tostring(customDimensions["DeclineReason"])
|extend Type = tostring(customDimensions["AcquiringInstitutionId"])
|extend dw = dayofweek(timestamp)
|where toint(dw) <6
|where timestamp between (LW_end .. Lw_start)
|where name =='TransactionsDeclined'
|summarize Week_Avg=sum(valueCount)/5 by tostring(Dec_Reasion) ;

Curr
|join kind=leftouter Trend on Dec_Reasion
|join kind=leftouter weekTrend on Dec_Reasion
|project Dec_Reasion,CurrentVal,Yesterday_total,Week_Avg

CodePudding user response：

This query can be written in a way that does not require joins.
You might want to give it a try.

let Yes_End = ago(24h);
let Yes_Start = ago(48h);
let N = ago(1m);
let LW_end = ago(14d);
let Lw_start = ago(7d);
customMetrics
| where     timestamp between (LW_end .. Lw_start) 
        or  timestamp between (Yes_Start .. N)
| where name == 'TransactionsDeclined'
| extend    Dec_Reasion = tostring(customDimensions["DeclineReason"])
           ,Type        = tostring(customDimensions["AcquiringInstitutionId"])
| summarize CurrentVal      = sumif(valueCount, timestamp between (Yes_End .. N)) 
           ,Yesterday_total = sumif(valueCount, timestamp between (Yes_Start .. Yes_End))
           ,Week_Avg        = sumif(valueCount, timestamp between (LW_end .. Lw_start) and where toint(dayofweek(timestamp)) < 6) / 5
            by Dec_Reasion