CODEWITHSUNDEEP
time-seriesazure-data-explorerkql
Kosh
Kosh

Reputation: 1246

KQL filter series by max value

I want to make a timechart but my graph is littered by series which have not significant values: enter image description here Is it possible to filter series by:

  1. Taking only a certain number of them with greatest max values
  2. Discarding all series with max value < const

My request is

let Step = timespan(1d);
let PeriodStart = ago(30d);
cluster("").database("").table("")
    | where Timestamp > PeriodStart
    | where Source == "courierapp" and isnotempty(CourierId)
    | summarize by CourierId, bin(Timestamp, Step), AppVersion
    | make-series Version=count() default=0 on Timestamp from PeriodStart to ago(0d) step Step by AppVersion
    | render timechart

Upvotes: 1

Views: 858

Answers (1)

David דודו Markovitz
David דודו Markovitz

Reputation: 44981

One possible solution is based on series_stats()

let threshold = 1000;
...  
| make-series Version=count() default=0 on Timestamp from PeriodStart to ago(0d) step Step by AppVersion
| extend series_stats(Version)
| where series_stats_Version_max >= threshold
| render timechart

Upvotes: 1

Related Questions