1
votes

I have two queries: both have similar results. I just want to draw both on one time chart in azure log analytics.

customEvents | where name startswith "USER_LOGIN" | extend responseTime_in_sec = todouble(customMeasurements.responseTime)/1000 | summarize avg(responseTime_in_sec) by responseTime_in_sec, bin(timestamp, 1h) | render timechart

customEvents | where name startswith "DEPENDENT_SERVICE" | extend responseTime_in_sec = todouble(customMeasurements.responseTime)/1000 | summarize avg(responseTime_in_sec) by responseTime_in_sec, bin(timestamp, 1h) | render timechart

enter image description here

1
maybe I'm missing something but what about simply this? customEvents | where name startswith "DEPENDENT_SERVICE" or name startswith "USER_LOGIN" | extend responseTime_in_sec = todouble(customMeasurements.responseTime)/1000 | summarize avg(responseTime_in_sec) by name, responseTime_in_sec, bin(timestamp, 1h) | render timechartsilent
Thanks @silent, I literally feel like an idiot. I tried everything like 'let', 'union'; but missed this simple thing.Nitin Kumar
so this worked? then I'll make an answer out of it :)silent
@silent You can add it as answer to share the useful info to more members.Just a reminder :)LoLance

1 Answers

1
votes

As discussed in the comments, sometimes the solution can be quite easy :)

customEvents 
| where name startswith "DEPENDENT_SERVICE" or name startswith "USER_LOGIN" 
| extend responseTime_in_sec = todouble(customMeasurements.responseTime)/1000 
| summarize avg(responseTime_in_sec) by name, responseTime_in_sec, bin(timestamp, 1h) 
| render timechart

If the query is more complex than this, often the union operator can help as welll.