5
votes

I'm looking to create buckets for certain requests based on duration. So requests for name "A", I need a count of when the duration was less than <2secs, 2secs- 4secs and >4secs. I get the data individually using:

requests
| where name == "A"
| where duration <= 2000
| summarize count()

but what I really need is the number as a percentage of the total "A" requests, for example, a table like:

Name <2secs 2-4 secs >4secs A 89% 98% 99%

Thanks, Chris

1

1 Answers

6
votes

One way to do it is to rely on performanceBucket field. This will give some distribution but performance buckets are preconfigured.

requests
| where timestamp > ago(1d)
| summarize count() by performanceBucket

Another approach is to do something like this:

requests
| where timestamp > ago(1d)
| extend requestPeformanceBucket = iff(duration < 2000, "<2secs",
    iff(duration < 2000, "2secs-4secs", ">4secs"))
| summarize count() by requestPeformanceBucket

And here is how to get percentage:

let dataSet = requests
| where timestamp > ago(1d);
let totalCount = toscalar(dataSet | count);
dataSet
| extend requestPeformanceBucket = iff(duration < 2000, "<2secs",
    iff(duration < 2000, "2secs-4secs", ">4secs"))
| summarize count() by requestPeformanceBucket
| project ["Bucket"]=requestPeformanceBucket, 
          ["Count"]=count_, 
          ["Percentage"]=strcat(round(todouble(count_) / totalCount * 100, 2), "%")

enter image description here