CODEWITHSUNDEEP
azureazure-application-insightsazure-data-explorerkql
vumaasha
vumaasha

Reputation: 2845

Kusto: make-series stops with first day - doesnt work as expected

I am using azure customer metrics to store application usage metrics, I am exporting the stats every 5 minutes. I am using the query below to create a aggregated series without any gaps.

I expect the start to be 5/10/2020, 12:00:00.000 AM and end to be 5/14/2020, 12:00:00.000 AM. However in my results, start is fine , but the end is 5/10/2020, 10:35:00.000 AM. I am running this query on 5/13/2020, 4:09:07.878 AM. The min timestamp in my data is 5/11/2020, 12:54:06.489 PM and max is 5/12/2020, 2:32:47.459 PM.

What is wrong with my query? why the make-series wouldn't give rows beyond day 1

let start = floor(ago(1d),1d);
let end = floor(now(+1d),1d); 
customMetrics
| where timestamp >= start
| where name == "endpoint_access_count_count_view"
| extend customMetric_valueSum = iif(itemType == 'customMetric',valueSum,todouble(''))
| make-series n_req = sum(customMetric_valueSum) on timestamp from start to end step 5m
| mvexpand n_req,timestamp
| extend  timestamp=todatetime(timestamp),n_req=toint(n_req)

Upvotes: 0

Views: 440

Answers (1)

Yoni L.
Yoni L.

Reputation: 25955

mvexpand, unlike mv-expand (note the hyphen), has a default limit of 128 values, so your results get truncated.

https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/mvexpandoperator

Upvotes: 2

Related Questions