Search code examples
azureazure-data-explorerkql

How to divide my datetime data into series data along with its values in kusto


I have a dataset with date values and and its corresponding status values.

I want to generate missing date values by one hour along with its status values.

Is it possible to do in kusto.

Data

I have tried generating it with make-series but it's allowing only default values in output, but i need status value instead of default some constant value


Solution

  • datatable(Time:timespan, Status:int)
    [
        timespan(00:00), 4
       ,timespan(04:00), 2
       ,timespan(12:00), 4
       ,timespan(20:00), 2
    ]
    | make-series take_any(Status) default=int(null) on Time step 1h
    | mv-expand Time to typeof(timespan), series_fill_forward(Status) to typeof(int)
    
    Status Time
    4 00:00:00
    4 01:00:00
    4 02:00:00
    4 03:00:00
    2 04:00:00
    2 05:00:00
    2 06:00:00
    2 07:00:00
    2 08:00:00
    2 09:00:00
    2 10:00:00
    2 11:00:00
    4 12:00:00
    4 13:00:00
    4 14:00:00
    4 15:00:00
    4 16:00:00
    4 17:00:00
    4 18:00:00
    4 19:00:00
    2 20:00:00

    Fiddle