CODEWITHSUNDEEP
azureazure-application-insightsazure-data-explorerkql
Tyler V
Tyler V

Reputation: 323

Using filtering in Shared Dashboard with KQL

I am trying to add some functionality via a Shared Dashboard using my telemetry logged to application insights,

This query gives me the desired result rendered in a barchart, when I apply filters for the customDimensions of FileName and Name and apply take 25 it renders great and shows me the 25 slowest invocations of a particular durable azure function with the operation id as the y-axis and the computed duration (ms) on the x-axis

Example Example 2

customEvents
| extend FileName = tostring(customDimensions["FileName"])
| extend Name = tostring(customDimensions["Name"])
| extend OperationId = operation_Id
| summarize Duration=datetime_diff('millisecond', max(timestamp), min(timestamp)) by OperationId, Name, FileName
| order by Duration desc
| render barchart with (xtitle="Operation Id", ytitle="Duration (ms)", legend=hidden)

When I try to add this same query (without the Where clauses) to a Shared Dashboard, I then go to apply the same filters of FileName, Name and I see different results.

  1. I am not able to apply take 25 as that limits the FileName available for me to chose from over a 30 day period
  2. As I select FileName and Name I can see the graph changes but when I go to select a OperationId the list total remains the same and does not filter based on the previous inputs

Shared Dashboard Shared Dashboard Query

How can I replicate the same results as in the first image shown where I am querying with provided FileName and Name and take only a subset (first 25) - while still being able to apply filters in a Shared Dashboard?

I have tried using a Workbook but unfortunately these queries compiled from appinsights log query appear different and you are unable to hide things like legends, etc. so it is not desirable

Upvotes: 1

Views: 830

Answers (1)

Delliganesh Sevanesan
Delliganesh Sevanesan

Reputation: 4776

How can I replicate the same results as in the first image shown where I am querying with provided FileName and Name and take only a subset (first 25) - while still being able to apply filters in a Shared Dashboard?

  1. I am not able to apply take 25 as that limits the FileName available for me to choose from over a 30-day period

I have noticed that in your query you are collecting all information while using extend.

Using the same query which you have used enter image description here

Filtering 25 values of the overall result enter image description here

Results in Shared Dashboard enter image description here

  1. As I select FileName and Name I can see the graph changes but when I go to select a OperationId the list total remains the same and does not filter based on the previous inputs

You can use ${Filter_Name } to dynamically use filter value in your query.

Eg:

Event | where ${Computers} | summarize count() by EventLevelName

Upvotes: 2

Related Questions