'KQL filter series by max value
I want to make a timechart but my graph is littered by series which have not significant values:
Is it possible to filter series by:
- Taking only a certain number of them with greatest max values
- Discarding all series with max value < const
My request is
let Step = timespan(1d);
let PeriodStart = ago(30d);
cluster("").database("").table("")
| where Timestamp > PeriodStart
| where Source == "courierapp" and isnotempty(CourierId)
| summarize by CourierId, bin(Timestamp, Step), AppVersion
| make-series Version=count() default=0 on Timestamp from PeriodStart to ago(0d) step Step by AppVersion
| render timechart
Solution 1:[1]
One possible solution is based on series_stats()
let threshold = 1000;
...
| make-series Version=count() default=0 on Timestamp from PeriodStart to ago(0d) step Step by AppVersion
| extend series_stats(Version)
| where series_stats_Version_max >= threshold
| render timechart
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
| Solution | Source |
|---|---|
| Solution 1 | David דודו Markovitz |
