Analyze logs and metrics with KQL

Bundled into the existing Developing AI Cloud Solutions on Azure premium course — no separate purchase.

14-day money-back guarantee — no questions asked.

Included in this chapter:

Question you are answering	summarize … by <dimension>	summarize … by bin(<time>, <step>)	make-series … on <time> step <step>
Result shape	One row per group	One row per group per interval	One row per group; each aggregate column is an array
Intervals with no matching rows	Not applicable	No row is produced, so the gap is invisible	An element is still produced, holding the declared default (0 unless you set one)
Getting back to one row per point	Already one row per group	Already one row per point	Expand the arrays with mv-expand
Usable by the series interpolation functions	No	No	Yes, and only where the default is double(null)
Typical question	Which result codes are driving the failures	When did the spike start	What does the whole window look like, idle intervals included

Cheat sheet

KQL chains tabular operators with the pipe, each transforming the previous result
summarize with a by clause groups rows and computes aggregates per group
A TimeGenerated filter in the query sets the Log Analytics time range - unless the source is a classic app(), where both windows apply
On a Basic or Auxiliary table the query is limited to one table - join, find, search and externaldata are unavailable
A log query is capped at 500,000 records, ~100 MB and 10 minutes, and a multi-region scope is warned then blocked
Kusto's datetime and term indexes dictate the order of where predicates and the choice of has over contains
Application Insights exposes one table per telemetry type, and which of them fill depends on how the app is instrumented
join and union correlate rows across telemetry tables
Application Insights tables keep ninety days for free while the rest of the workspace keeps thirty
A custom metric is stored twice, and the two copies do not carry the same dimensions
bin() buckets timestamps into intervals so summarize can build a time series
ago() and datetime comparisons scope a query to a time range
make-series returns gap-free arrays because empty intervals take the declared default
render timechart demands a leading datetime column and splits lines on a string column
Failed-request triage filters requests by success and groups by result code
Slow-dependency triage aggregates dependency duration, including tail latency

Unlock with Premium — includes all practice exams and the complete study guide.

Cheat sheet