Azure Kusto time series

Question

We are having some trouble using the time charts in Azure Kusto. In this chart we have grouped http exceptions over time.

The issue is that the chart still reports the last seen value for points in time where that exception does not exist. See red markings. In this specific case we see that the chart reports 3.23k exceptions on the /poll endpoint at 5:28. while there are in fact no such error at that time.

The query looks like this

AppServiceHTTPLogs
| where TimeGenerated > ago(1d)
| where ScStatus >= 500
| summarize count() by tostring(CsUriStem), bin(TimeGenerated, 30m)
| render timechart

Using a column chart makes the issue go away, but this comes with the price of being much less clear. Are there any other options?

Can we somehow make missing values default to 0 instead?

Answer 1

You should be able to fill with default zeros using make-series operator:

https://docs.microsoft.com/en-us/azure/data-explorer/kusto/query/make-seriesoperator

AppServiceHTTPLogs
| where TimeGenerated > ago(1d)
| where ScStatus >= 500
| make-series count() on TimeGenerated from ago(1d) to now() step 30min by tostring(CsUriStem)
| render timechart

Some UX clients do not know how to represent series data - and in this case you can expand it using mv-expand:

AppServiceHTTPLogs
| where TimeGenerated > ago(1d)
| where ScStatus >= 500
| make-series count() on TimeGenerated from ago(1d) to now() step 30min by tostring(CsUriStem)
| mv-expand count_ to typeof(long)
| render timechart