0
votes

My below query returns a table with the corresponding values

union (traces), (customEvents)
| where timestamp <= now()
| summarize Users=dcount(user_AuthenticatedId) by Country=client_CountryOrRegion
| sort by Users desc

Results:

enter image description here

When pinning the query to the dashboard, I see different results:

enter image description here

The only difference that I can see is the time range set directly on the dashboard. I set this one to custom: 2016-07-06 to now to simulate the same value than in the query. I have checked and I only have logs from 2019 anyway.

Has anyone a clue?

1

1 Answers

0
votes

Whenever I have seen this it is due to time slicing. You could add min and max timestamp values to the query in order to understand the exact ranges:

union (traces), (customEvents) | where timestamp <= now() | summarize Users=dcount(user_AuthenticatedId), FirstRecord=min(timestamp), LastRecord=max(timestamp) by Country=client_CountryOrRegion | sort by Users desc