I am trying to summarize a few events based on EIDs, but the result is only displaying for eve_1
and not eve_2
since (based on my data) since eve_2
count is 0.
How can I display eve_2 even when the count is 0 in this case?
Table
| where DateTime > ago(7d)
| where EID in (11, 22, 33)
| extend
Evet_cat = case(EID in (11 22), "eve_1",
EID == 33, "eve_2",
"others"
),
Date_time = format_datetime(DateTime, 'yyyy-MM-dd HH')
| summarize count() by Date_time, Evet_cat
| order by Date_time desc
How can I make sure both eve_1 and eve_2 are displayed even if their count is 0?
Update: I realize my wording of the question may be wrong. What I'm looking for is that. I'm trying to set a default (0) for any column that does not have a count, if there is a count, that should be displayed as usual.
So, something like:
| Date_time | Evet_cat | count_ |
|---------------|----------|--------|
| 2023-02-24 13 | eve_1 | 10 |
| 2023-02-24 13 | eve_2 | 0 |
| 2023-02-24 12 | eve_1 | 5 |
| 2023-02-24 12 | eve_2 | 0 |
the original query I had would have produced something like this:
| Date_time | Evet_cat | count_ |
|---------------|----------|--------|
| 2023-02-24 13 | eve_1 | 10 |
| 2023-02-24 12 | eve_1 | 5 |
Ultimately, I am looking to get the data to display like this:
| Date_time | eve_1 | eve_2 |
|---------------|----------|--------|
| 2023-02-24 13 | 10 | 0 |
| 2023-02-24 12 | 5 | 0 |
// Sample data generation. Not part of the solution.
let Table = materialize(range i from 1 to 200 step 1 | extend DateTime = ago(7d * rand()), EID = tolong((rand(3) + 1) * 11));
// Solution starts here.
Table
| where DateTime > ago(7d)
| where EID in (11, 22, 33)
| extend Evet_cat = case(EID in (11, 22), "eve_1", EID == 33, "eve_2", "others")
,Date_time = format_datetime(DateTime, 'yyyy-MM-dd HH')
| evaluate pivot(Evet_cat, count(), Date_time)
Date_time | eve_1 | eve_2 |
---|---|---|
2023-02-17 20 | 0 | 2 |
2023-02-22 23 | 1 | 1 |
2023-02-23 23 | 1 | 2 |
2023-02-18 11 | 0 | 1 |
2023-02-18 08 | 1 | 3 |
2023-02-22 08 | 2 | 0 |
2023-02-21 14 | 2 | 0 |
2023-02-18 17 | 2 | 1 |
2023-02-19 17 | 2 | 0 |
2023-02-24 10 | 1 | 0 |
2023-02-23 12 | 3 | 1 |
... | ... | ... |
2023-02-24 03 | 1 | 0 |
2023-02-23 01 | 1 | 0 |
2023-02-22 15 | 0 | 1 |
2023-02-20 08 | 1 | 0 |
2023-02-20 00 | 0 | 1 |