render operator
Instructs the user agent to render the results of the query in a particular way.
range x from 0.0 to 2*pi() step 0.01 | extend y=sin(x) | render linechart
Note
- The render operator should be the last operator in the query, and used only with queries that produce a single tabular data stream result.
- The render operator does not modify data. It injects an annotation ("Visualization") into the result's extended properties. The annotation contains the information provided by the operator in the query.
- The interpretation of the visualization information is done by the user agent. Different agents (such as Kusto.Explorer,Kusto.WebExplorer) might support different visualizations.
Syntax
T | render Visualization [with ( PropertyName = PropertyValue [, ...] )]
Arguments
- Visualization indicates the kind of visualization to use. The supported values are:
| Visualization | Description | Example |
|---|---|---|
anomalychart |
Similar to timechart, but highlights anomalies using series_decompose_anomalies function. | Click to run sample query |
areachart |
Area graph. First column is the x-axis and should be a numeric column. Other numeric columns are y-axes. | Click to run sample query |
barchart |
First column is the x-axis and can be text, datetime or numeric. Other columns are numeric, displayed as horizontal strips. | Click to run sample query |
card |
First result record is treated as set of scalar values and shows as a card. | Click to run sample query |
columnchart |
Like barchart with vertical strips instead of horizontal strips. |
Click to run sample query |
ladderchart |
Last two columns are the x-axis, other columns are y-axis. | |
linechart |
Line graph. First column is x-axis, and should be a numeric column. Other numeric columns are y-axes. | Click to run sample query |
piechart |
First column is color-axis, second column is numeric. | Click to run sample query |
pivotchart |
Displays a pivot table and chart. User can interactively select data, columns, rows and various chart types. | |
scatterchart |
Points graph. First column is x-axis and should be a numeric column. Other numeric columns are y-axes. | Click to run sample query |
stackedareachart |
Stacked area graph. First column is x-axis, and should be a numeric column. Other numeric columns are y-axes. | Click to run sample query |
table |
Default - results are shown as a table. | Click to run sample query |
timechart |
Line graph. First column is x-axis, and must be datetime. Other (numeric) columns are y-axes. There is one string column whose values are used to "group" the numeric columns and create different lines in the chart (further string columns are ignored). | Click to run sample query |
timepivot |
Interactive navigation over the events time-line (pivoting on time axis) |
Note
The ladderchart, pivotchart, and timepivot visualizations can be used in Kusto.Explorer but are not available in the Azure Data Explorer Web UI.
| Visualization | Description |
|---|---|
areachart |
Area graph. First column is the x-axis and should be a numeric column. Other numeric columns are y-axes. |
barchart |
First column is the x-axis and can be text, datetime or numeric. Other columns are numeric, displayed as horizontal strips. |
columnchart |
Like barchart with vertical strips instead of horizontal strips. |
piechart |
First column is color-axis, second column is numeric. |
scatterchart |
Points graph. First column is the x-axis and should be a numeric column. Other numeric columns are y-axes. |
table |
Default - results are shown as a table. |
timechart |
Line graph. First column is x-axis, and should be datetime. Other (numeric) columns are y-axes. There is one string column whose values are used to "group" the numeric columns and create different lines in the chart (further string columns are ignored). |
- PropertyName/PropertyValue indicate additional information to use when rendering. All properties are optional. The supported properties are:
| PropertyName | PropertyValue |
|---|---|
accumulate |
Whether the value of each measure gets added to all its predecessors. (true or false) |
kind |
Further elaboration of the visualization kind. See below. |
legend |
Whether to display a legend or not (visible or hidden). |
series |
Comma-delimited list of columns whose combined per-record values define the series that record belongs to. |
ymin |
The minimum value to be displayed on Y-axis. |
ymax |
The maximum value to be displayed on Y-axis. |
title |
The title of the visualization (of type string). |
xaxis |
How to scale the x-axis (linear or log). |
xcolumn |
Which column in the result is used for the x-axis. |
xtitle |
The title of the x-axis (of type string). |
yaxis |
How to scale the y-axis (linear or log). |
ycolumns |
Comma-delimited list of columns that consist of the values provided per value of the x column. |
ysplit |
How to split multiple the visualization. See below. |
ytitle |
The title of the y-axis (of type string). |
anomalycolumns |
Property relevant only for anomalychart. Comma-delimited list of columns which will be considered as anomaly series and displayed as points on the chart |
| PropertyName | PropertyValue |
|---|---|
kind |
Further elaboration of the visualization kind. See below. |
series |
Comma-delimited list of columns whose combined per-record values define the series that record belongs to. |
title |
The title of the visualization (of type string). |
yaxis |
How to scale the y-axis (linear or log). |
Some visualizations can be further elaborated by providing the kind property.
These are:
| Visualization | kind |
Description |
|---|---|---|
areachart |
default |
Each "area" stands on its own. |
unstacked |
Same as default. |
|
stacked |
Stack "areas" to the right. | |
stacked100 |
Stack "areas" to the right and stretch each one to the same width as the others. | |
barchart |
default |
Each "bar" stands on its own. |
unstacked |
Same as default. |
|
stacked |
Stack "bars". | |
stacked100 |
Stack "bars" and stretch each one to the same width as the others. | |
columnchart |
default |
Each "column" stands on its own. |
unstacked |
Same as default. |
|
stacked |
Stack "columns" one atop the other. | |
stacked100 |
Stack "columns" and stretch each one to the same height as the others. | |
scatterchart |
map |
Expected columns are [Longitude, Latitude] or GeoJSON point. Series column is optional. |
piechart |
map |
Expected columns are [Longitude, Latitude] or GeoJSON point, color-axis and numeric. Supported in Kusto Explorer desktop. |
Some visualizations support splitting into multiple y-axis values:
ysplit |
Description |
|---|---|
none |
A single y-axis is displayed for all series data. (Default) |
axes |
A single chart is displayed with multiple y-axes (one per series). |
panels |
One chart is rendered for each ycolumn value (up to some limit). |
Note
The data model of the render operator looks at the tabular data as if it has three kinds of columns:
- The x axis column (indicated by the
xcolumnproperty). - The series columns (any number of columns indicated by the
seriesproperty.) For each record, the combined values of these columns defines a single series, and the chart has as many series as there are distinct combined values. - The y axis columns (any number of columns indicated by the
ycolumnsproperty). For each record, the series has as many measurements ("points" in the chart) as there are y-axis columns.
Tip
- Use
where,summarizeandtopto limit the volume that you display. - Sort the data to define the order of the x-axis.
- User agents are free to "guess" the value of properties that are not specified by the query. In particular, having "uninteresting" columns in the schema of the result might translate into them guessing wrong. Try projecting-away such columns when that happens.
Example
range x from -2 to 2 step 0.1
| extend sin = sin(x), cos = cos(x)
| extend x_sign = iif(x > 0, "x_pos", "x_neg")
| extend sum_sign = iif(sin + cos > 0, "sum_pos", "sum_neg")
| render linechart with (ycolumns = sin, cos, series = x_sign, sum_sign)
Note
The data model of the render operator looks at the tabular data as if it has three kinds of columns:
- The x axis column (indicated by the
xcolumnproperty). - The series columns (any number of columns indicated by the
seriesproperty.) - The y axis columns (any number of columns indicated by the
ycolumnsproperty). For each record, the series has as many measurements ("points" in the chart) as there are y-axis columns.
Tip
- Use
where,summarizeandtopto limit the volume that you display. - Sort the data to define the order of the x-axis.
- User agents are free to "guess" the value of properties that are not specified by the query. In particular, having "uninteresting" columns in the schema of the result might translate into them guessing wrong. Try projecting-away such columns when that happens.
Example
InsightsMetrics
| where Computer == "DC00.NA.contosohotels.com"
| where Namespace == "Processor" and Name == "UtilizationPercentage"
| summarize avg(Val) by Computer, bin(TimeGenerated, 1h)
| render timechart