Show total occurrence grouped and as a total in Kusto

79 Views Asked by At

I'm quite new to Kusto and I'm trying to visualize something in an Azure Log Analytics workbook. I'm searching for occurrences of requests, translate IDs to human readable names using a custom function and group them by day. I can't find a way to also show the total occurrences (sum of all groups) only as a metric and not changing the chart.

My query looks like this:

    requests
    | where operation_Name == "Create History"
    | where customDimensions.SystemStatus == "Production"
    | extend systemid = tostring(customDimensions.SystemId)
    | extend system = tostring(system_lookup()[systemid])
    | summarize Services_Done = count() by bin(timestamp, 1d), system

Resulting in a time series bar chart like this: enter image description here

Chart settings: enter image description here

1

There are 1 best solutions below

2
RithwikBojja On

I can't find a way to also show the total occurrences (sum of all groups) only as a metric and not changing the chart.

If you do not want to change chart and get sum of all services then use below query:

let res=requests 
| extend ProcessId = tostring(customDimensions.ProcessId)
| extend system = tostring(ProcessId)
| summarize Services_Done = count() by bin(timestamp, 1d), system
| extend new_column = 0
| sort by new_column asc
| extend rn=row_number();
let res2=res
| summarize Total_Services_Done = sum(Services_Done) by bin(timestamp, 1d)
| extend new_column = 0
| sort by new_column asc
| extend rn=row_number();
res
| join kind=fullouter res2 on rn
| project-away new_column, rn,rn1,new_column1,timestamp1
| render barchart with (kind=stacked)

enter image description here

enter image description here