Log Analytics, 'Split-by' value in a KQL render query

Simon Magrin 121

Hi, is there a way to set the 'Split-by' value in a KQL render query? It defaults to a undesired column which I'm hoping to specify in the query, rather having to change it manually. Thanks!

bharathn-msft 5,086 Reputation points Microsoft Employee

2021-09-23T00:07:21.497+00:00

@Simon Magrin Welcome to Microsoft Q&A and thanks for your query.

I am further checking on this with our internal team, will keep you updated as I hear more information.
Simon Magrin 121 Reputation points

2021-09-28T11:56:12.243+00:00

Thanks and look forward to any updates. Kind Regards
bharathn-msft 5,086 Reputation points Microsoft Employee

2021-10-07T22:49:09.797+00:00
@Simon Magrin My sincere apologies for delay in getting back to you on this thread.

I was out of office and couldn't respond to you earlier. I did hear back from our internal team and seems that the only way of doing that is to use a summarize function followed by a ‘by’ operator that will enforce a segmentation of specific dimension.

Below is an example where we forced it with Statuscode.

StorageBlobLogs | render columnchart with(title="Authentication", xtitle="Time", ytitle="Duration") | summarize count() by bin(TimeGenerated, 5m), StatusCode

Hope this helps. Let us know if you have any further queries. Thank you

Accepted answer

bharathn-msft 5,086 Reputation points Microsoft Employee

2021-10-10T19:26:49.343+00:00
<<Converting the information from comments to here for broader community usage>>

@Simon Magrin - Thanks again for your query, post review with our internal team it has been called out that the only way of doing this is to use a summarize function followed by a ‘by’ operator that will enforce a segmentation of specific dimension.

Below is an example where we forced it with Statuscode.

StorageBlobLogs | render columnchart with(title="Authentication", xtitle="Time", ytitle="Duration") | summarize count() by bin(TimeGenerated, 5m), StatusCode

Hope this helps. Let us know if you have any further queries. Thank you
Please sign in to rate this answer.
Simon Magrin 121 Reputation points

2021-11-01T11:42:17.87+00:00

Apologies for the belated reply, Thanks @bharathn-msft , that worked!

Kind Regards

bharathn-msft 5,086 Reputation points Microsoft Employee

2021-11-01T14:58:24.377+00:00

Glad to hear that it worked @Simon Magrin . Thank you.
Sign in to comment

Log Analytics, 'Split-by' value in a KQL render query

0 additional answers