0

I am trying to display result using Kusto KQL query in pie chart.The goal is to display pie chart as half n half color in case of failure and full color in case of pass. Basically log from a site displays rows as pass and failed row .In case where all are pass , pie chart should display 100 % same color.In case of even single failure in any rows , it should display 50% one color and 50% other color.Below query works when 1) When all rows are pass as full color 2) when some are pass and some fail or even one fails (displays pie chart in half n half) color 3)BUT WHEN ALL ROW HAS FAILS ,this is displaying in one color and not splitting pie chart in half n half

QUERY I USED:

results
| where Name contains "jobqueues"
| where timestamp > ago(1h)
| extend PASS = (ErLvl)>2 )
| extend FAIL = ((ErLvl<2 )
| project PASS ,FAIL
| extend status = iff(PASS==true,"PASS","FAIL")
| summarize count() by status
| extend display = iff(count_>0,1,0)
| summarize percentile(display, 50) by status
| render piechart

Please suggest what can be done to solve this problem.Thanks in advance.

Sangeeta Singh
  • 1
  • 2

1 Answers1

2

Let's summarize your question:

There are only two outcomes of your query:

  1. A piechart showing 50% vs 50%
  2. A piechart showing 100%

From your description we learn that when

  1. All rows are PASS we plot piechart 2.
  2. Any row has FAIL we plot piechart 1.

Lets see how we can achieve this after this line from your code:

| extend status = iff(PASS==true,"PASS","FAIL")
| summarize count() by status

We should have a table looking like so:

status count_
PASS x
FAIL y

Looks like we need to perform some logic on this. You were originally plotting based on the operation result. My idea was to just generate a table of pass = 1 and fail = 1 for the 50%v50% case and another table of pass = 1 and fail = 0 for the 100% case.

So following that logic we need to perform the following mapping:

status count_ status count2
fail >0 maps to fail 1
pass >0 pass 1
status count_ status count2
fail >0 maps to fail 1
pass =0 pass 1
status count_ status count2
fail =0 maps to fail 0
pass >0 pass 1

Logical representation:

(given count_ >=0):
if fail > 0  count2 = 0 else count 1
pass is always equal to 1

We only need to apply this to the row where status == FAILED but summarize doesn't guarantee a row if there are no observations

Guarantee summarize results:

| extend fail_count = iif(status == "FAIL", count_, 0)
| extend pass_count = iif(status == "PASS", count_, 0)
| project fail_count,pass_count
| summarize sum(fail_count), sum(pass_count)

Apply logic

| extend FAIL = iff(sum_fail_count > 0, 1, 0)
| extend PASS = 1
| project FAIL, PASS

Now our result is looking like:

PASS FAIL
1 1 or 0

In order to plot this as a pie chart we just need to transpose it so the columns PASSED and FAILED are rows of the "status" column.
We can use a simple pack and mv-expand for this

//transpose for rendering 
| extend tmp = pack("FAIL",FAIL,"PASS",PASS)
| mv-expand kind=array tmp
| project Status=tostring(tmp[0]), Count=toint(tmp[1])
| render piechart

And that's it!~

Final query:

results
| where Name contains "jobqueues"
| where timestamp > ago(1h)
| extend PASS = (ErLvl)>2 )
| extend FAIL = ((ErLvl<2 )
| project PASS ,FAIL
| extend status = iff(PASS==true,"PASS","FAIL")
| summarize count() by status
//ensure results
| extend fail_count = iif(status == "FAIL", count_, 0)
| extend pass_count = iif(status == "PASS", count_, 0)
| project fail_count,pass_count
| summarize sum(fail_count), sum(pass_count)
//apply logic
| extend FAIL = iff(sum_fail_count > 0, 1, 0)
| extend PASS = 1
| project FAIL, PASS
//transpose for rendering 
| extend Temp = pack("FAIL",FAIL,"PASS",PASS)
| mv-expand kind=array Temp
| project Status=tostring(Temp[0]), Count=toint(Temp[1])
| render piechart
Geoffrey Cai
  • 159
  • 7