makeTimeseries from DQL to chart EC2 instances used by Kubernetes

[roberto_camp1]

I have the following DQL query that I would like visualize as a simple bar or donut chart, to display the ec2 instance types of the worker nodes in my EKS cluster at any give time.

We have multiple EKS clusters in several different development and production accounts and tracking ec2 instance type might be of value to us.

I am having difficulty mapping the query to the makeTimeseries command.

Can anyone suggest a nice way to achieve this?

```
fetch dt.entity.kubernetes_node
| filter in(id, classicEntitySelector("type(KUBERNETES_NODE),toRelationship.isClusterOfNode(type(KUBERNETES_CLUSTER),entityName.equals(operations-1))"))
| fields entity.name
| lookup [fetch dt.entity.ec2_instance | fields localHostName, awsInstanceType],lookupField:localHostName,sourceField:entity.name

// | makeTimeseries count()
| makeTimeseries count(default: 0), interval: 30m

```

I keep getting the error: "Please specify the parameter `time` explicitly, as the implicit default `timestamp` doesn't exist."

[krzysztof_hoja · Accepted solution]

In this case case there is no need to (and in fact you cannot) use makeTimeseries
Time dimension does not exist in result of fetch <entity> query. To count occurrences of particular field summarize is enough:

fetch dt.entity.kubernetes_node
//| filter in(id, classicEntitySelector("type(KUBERNETES_NODE),toRelationship.isClusterOfNode(type(KUBERNETES_CLUSTER),entityName.equals(operations-1))"))
| fields entity.name
| lookup [
    fetch dt.entity.ec2_instance 
    | fields localHostName, awsInstanceType
    ], lookupField:localHostName, sourceField:entity.name
| summarize {cnt=count()}, by: {lookup.awsInstanceType}
| fieldsAdd lookup.awsInstanceType = coalesce(lookup.awsInstanceType, "Unknown")
| sort cnt desc

note: I commented out filer for cluster name. I do not have such name in  my environment. Result looks like: 

[roberto_camp1]

Thank you @krzysztof_hoja that works very well!