5

I query a request log for a summary of status codes. However I would like to add a row at the end of the results, showing the total number of requests. How do I add such a row?

Current query (simplified)

MyLog
| summarize count() by responseCode

Current result looks like

responseCode count
200 1000
404 20
500 100

I would like to have the totals like this

responseCode count
200 1000
404 20
500 100
total 1120
Yoni L.
  • 22,627
  • 2
  • 29
  • 48
Brandhout
  • 128
  • 1
  • 6

1 Answers1

4

you could try this:

MyLog
| summarize c = count() by responseCode
| as hint.materialized=true T
| union (T | summarize c = sum(c) by responseCode = "total")

or this:

MyLog
| summarize c = count() by responseCode
| union (print responseCode = "total", c = toscalar(MyLog | count))

if you want to keep the 'total' row last, you can order the unioned data set. for example:

MyLog
| summarize c = count() by responseCode
| extend _o = 0
| union (
    print responseCode = "total",
          c = toscalar(MyLog | count),
          _o = 1
)
| order by _o asc, c desc
| project-away _o
Yoni L.
  • 22,627
  • 2
  • 29
  • 48
  • 1
    I don't suppose there's a way to keep this row at the bottom of the table when the columns are sorted? – Nick Oct 12 '22 at 12:42
  • 1
    you'll have to order the unioned data set according to the order of your choice. see updated answer with an example – Yoni L. Oct 12 '22 at 17:26