The following query returns the data that I need:
let timeSpn = bin(ago(60m),1m);
requests
| where cloud_RoleName == "myApp"
| where success == "False"
| where timestamp > timeSpn
| make-series count() on timestamp from timeSpn to now() step 1m by application_Version
The problem is that the result consist of 2 lines (one for each application_Version
and not 120 lines (one for each minute and for each version).
I have to use make-series
and not the simple summarize
because I need the "zero" values.
You can do it using the
mv-expand
operatorHere's an example from Back-fill Missing Dates With Zeros in a Time Chart: