topic DQL TimeSeries in DQL

DQL TimeSeries

Gib80 — Fri, 04 Oct 2024 08:13:49 GMT

Hi All,

I have created a timeseries DQL for a dashboard and I have got so far and I'm now stuck. It produces a line chart for me, but I need the CountofRecords to be one value per 30 min interval (see attached image).

timeseries interval:30m, Requests = sum(log.application),by: {event.original, application}
| parse event.original, """LD '@mt":' LD:mt ',' """
| filter matchesPhrase(application, "API")
| filter matchesPhrase(mt, "Get request received")
| fieldsAdd CountofRecords=arraymovingSum(Requests, 30)

Any help would be appreciated.

Re: DQL TimeSeries

sinisa_zubic — Fri, 04 Oct 2024 08:24:36 GMT

Hi @Gib80

How about this query:

timeseries interval:30m, Requests = sum(log.application),by: {event.original, application}, filter: matchesPhrase(application, "API") | parse event.original, """LD '@mt":' LD:mt ',' """ | filter matchesPhrase(mt, "Get request received") | summarize CountofRecords = sum(Requests[]) interval = takeAny(interval), timeframe = takeAny(timeframe) | fieldsAdd CountofRecordsMoving=arraymovingSum(CountofRecords, 30)

I am not sure why you are using the arrayMovingSum function

Best,
Sini

Re: DQL TimeSeries

Gib80 — Fri, 04 Oct 2024 08:35:05 GMT

Perfect, that worked brilliantly! Thank you.