I have created an OpenPipeline and try to manipulate the data to create a TimeSeries for web request count over time and sum for total web requests within a set time period (vary with the time period set in dashboard)
I have tried to use the following DQL
timeseries { sum(webrequest), value.A = avg(webrequest, scalar: true) }, by: { azure.location, duration, server.address, TenantID, Tenant, url.path, k8s.cluster.name, k8s.namespace.name, k8s.workload.name, dt.host_group.id, dt.entity.service }
| fieldsAdd dt.entity.service.name = entityName(dt.entity.service)
| fieldsAdd Tenant = if (tolong(TenantID) == 1, "Country A")
| fieldsAdd Tenant = if (tolong(TenantID) == 2, "Country B", else:Tenant)
| fieldsAdd Tenant = if (tolong(TenantID) == 3, "Country C", else:Tenant)
| filterOut isNull(Tenant)
| makeTimeSeries webrequestcount = count(), by:{ TenantID, Tenant }
| fieldsAdd sum_webrequestcount = arraySum(webrequestcount)
| sort sum_webrequestcount descHowever, it returns the following error:
When I check the data by comment out those 3 makeTimeSeries statments, the data does include timestamp data:
Why does that happen?
Featured Posts
