CODEWITHSUNDEEP
kqlkusto-explorer
raindrop
raindrop

Reputation: 523

azure kusto join multiple graph/table two one

I try combining the two graphs I have now (working as expected) into one combined to show In and out. I have used the join command I assume that worked but didn't. did I miss anything?

syslog_CL
| where data_s  contains  "out"
| where hostname_s contains "interface"
| where TimeGenerated > ago(1hr)  
| summarize Reject=dcount(data_s) by bin(TimeGenerated, 5m)
| project Reject
| join kind = inner (
syslog_CL
| where data_s  contains  "in"
| where hostname_s contains "interface"
| where TimeGenerated > ago(1hr)
| summarize allow=dcount(data_s) by bin(TimeGenerated, 5m)
| project allow
 )
 | order by timestamp asc

Upvotes: 0

Views: 1152

Answers (1)

Yoni L.
Yoni L.

Reputation: 25955

you could try this instead, using the dcountif() aggregation function:

syslog_CL
| where TimeGenerated > ago(1hr)  
| where hostname_s contains "interface"
| summarize reject = dcountif(data_s, data_s contains "out"),
            allow = dcountif(data_s, data_s contains "in")
         by bin(TimeGenerated, 5m)
| render timechart

Upvotes: 1

Related Questions