CODEWITHSUNDEEP
azure-application-insightskql
user3012708
user3012708

Reputation: 946

Application Insights - Calculate timespan between two events that have the same operation Id?

I've a lot of events in the traces section of Application Insights. I'm interested in two events "Beginning" and "End", they each have the same operation Id as they're logged in sets. Sometimes the "End" event won't exist - as there will have a been a problem with the application we're monitoring.

We can say, for the sake of argument that we have these fields that we're interested in: timestamp, eventName, operationId

How can i calculate the exact time between the two timestamps for the pair of events for all unique operation Ids in a timespan?

My initial thought was to get the distinct operationIds from traces, where the eventName is "Beginning"... But that's as far as i get, as i'm not really sure how to perform the rest of the operations required. (Namely - the calculation, and checking if the "End" event even exists).

let operations =
    traces
    | where customDimensions.eventName = "Beginning"
    | distinct operationId

Any help would be greatly appreciated!

EDIT: I'm obviously thinking about this all wrong. What i'm after is non-unique operationIds. This will filter out missing "end" events. If i could then merge the resulting results together, based on that id, i would then have 2 timestamps, which i could operate on.

Upvotes: 1

Views: 1223

Answers (1)

user3012708
user3012708

Reputation: 946

So, i figured it out after some coffee and time to think.

Ended up with:

let a =
    traces
    | summarize count() by operation_Id;
let b = 
    a
    | where count_ == 2
    | project operation_Id;
let c = 
    traces
    | where operation_Id in (b)
    | join kind = inner(traces) on operation_Id
    | order by timestamp,timestamp1
    | project evaluatedTime=(timestamp1 - timestamp), operation_Id, timestamp;
c
| where evaluatedTime > timespan(0)
| project seconds=evaluatedTime/time(1s), operation_Id, timestamp

Upvotes: 4

Related Questions