Search code examples
azurekqlazure-monitoringazure-monitor-workbooks

How to display line over line chart for requests in Azure Monitor workbook?

I am trying to create a requests per minute time (RPM) chart in Azure Monitor workbook for requests which are throttled and non-throttle in the form of two lines (overlayed). I manage to create a time chart for RPM with one line but what is the best way to show two distinct lines for each type of request.

enter image description here

Here is the KQL for the chart. Thinking to perform self-join on the table (T) based on ResultType (Throttled and Non-Throttled) but not sure about it. Maybe a better solution out there.

let T = datatable(Timestamp:datetime, ResultType:string, ResultSignature:string, CorrelationId:string) [
"2022-03-02T14:25:21.8262878Z", "Throttled", "200", "be8bd024-8f5c-4a01-9703-2945ef3bc8ba",
"2022-03-02T14:25:35.3729584Z", "Throttled", "200", "66ed2194-ffa2-43ae-96f4-d3d8d1fb4c4d",
"2022-03-02T14:25:35.5681385Z", "Throttled", "200", "37b33938-0498-4e66-b16e-8c77ac9cf6b9",
"2022-03-02T14:25:35.9571988Z", "Throttled", "200", "cc9a0638-37b2-4c25-8578-8df206896de0",
"2022-03-02T14:25:38.1975426Z", "Throttled", "200", "2b70359d-1732-4cfe-8eda-ef993bbd638a",
"2022-03-02T14:25:38.3044257Z", "Throttled", "200", "9143b5fc-c074-467a-bb97-9765e698e3ff",
"2022-03-02T14:25:40.0240219Z", "Throttled", "200", "8cd18445-556e-44fe-81d8-38e261fddb02",
"2022-03-02T14:25:48.3866310Z", "Throttled", "200", "c5d21533-e1cd-484a-aee2-d05b804eecf0",
"2022-03-02T14:26:03.2572998Z", "Throttled", "200", "46c47f34-2402-45e1-ba8b-fea4d2e59640",
"2022-03-02T14:28:23.1553098Z", "Non-Throttled", "302", "fa309b65-b0b7-43d3-b3aa-9b6de6ce17cb",
"2022-03-02T14:28:23.9385460Z", "Non-Throttled", "200", "daedb13f-8b3e-4268-9803-b3bf8039d776",
    ];
T 
    | project Timestamp, ResultType, ResultSignature , CorrelationId
    | summarize TotalRequests = count() by bin(Timestamp,1m)
Solution

  • you can add ResultType as an aggregation key.

    i.e. you can replace this:

    | summarize TotalRequests = count() by bin(Timestamp,1m)

    with this:

    | summarize TotalRequests = count() by ResultType, bin(Timestamp,1m)