I am struggling to create anAppInsight query...
I want to get the number of times an application is started and divide it by the number of times a certain event is triggered (spell checker).
In reality, I have 3 applications which all use the same spellchecker functionality and I want to see if spell checking is used the same amount in each application.
//First, let's get the count of hasBeenUsed (how many times the application has been used)
let app1Starts =
customEvents
| where timestamp > ago(30d)
| where name == 'hasBeenUsed';
| where customDimensions['payload.appId] == 'app1'
| summarize count();
//Now, let's get the count of how many times spellchecking has happened for that specific application
let spellCheckEvents =
customEvents
| where timestamp > ago(30d)
| where name == 'spellchecked';
| where customDimensions['payload.appId] == 'app1'
| summarize count();
//this is where I struggle
customEvents
| summarize app1Starts / spellCheckEvents //HELP ME PLEASE
I get the error message
'summarize' operator: Failed to resolve scalar expression named 'app1Starts'
Same happens if I change that last line from summarize to extend
You can use toscalar() operator in the let statement.
In your case, the query should be:
//First, let's get the count of hasBeenUsed (how many times the application has been used)
let app1Starts =toscalar(
customEvents
| where timestamp > ago(30d)
| where name == 'hasBeenUsed'
| where customDimensions['payload.appId] == 'app1'
| summarize count());
//Now, let's get the count of how many times spellchecking has happened for that specific application
let spellCheckEvents =toscalar(
customEvents
| where timestamp > ago(30d)
| where name == 'spellchecked'
| where customDimensions['payload.appId] == 'app1'
| summarize count());
//then you can use the following statement
customEvents
| extend c1=app1Starts/spellCheckEvents