Follow

Keep Up to Date with the Most Important News

By pressing the Subscribe button, you confirm that you have read and are agreeing to our Privacy Policy and Terms of Use
Contact

Using KQL (Kusto query language), how to group datetimes into weeks (or 7-day chunks)?

I am running KQL (Kusto query language) queries against Azure Application Insights. I have certain measurements that I want to aggregate weekly. I am trying to figure out how to split my data into weeks.

To illustrate what I seek, here is a query that computes daily averages of the duration column.

requests 
| where timestamp > ago(7d)
| summarize 
    avg(duration)
    by 
        Date = format_datetime(timestamp, "yyyy-MM-dd")

This produces something similar to this:

MEDevel.com: Open-source for Healthcare and Education

Collecting and validating open-source software for healthcare, education, enterprise, development, medical imaging, medical records, and digital pathology.

Visit Medevel

enter image description here

In the above I have converted datetimes to string and thus effectively "rounded them down" to the precision of one day. This may be ugly, but it’s the easiest way I could think of in order to group all results from a given day. It would be trivial to round down to months or years with the same technique.

But what if I want to group datetimes by week? Is there a nice way to do that?

I do not care whether my "weeks" start on Monday or Sunday or January 1st or whatever. I just want to group a collection of KQL datetimes into 7-day chunks. How can I do that?

Thanks in advance!

>Solution :

Looks like you are looking for the "bin()" function:

requests 
| where timestamp > ago(7d)
| summarize 
    avg(duration)
    by 
        bin(timestamp, 1d) // one day, for 7 days change it to 7d
Add a comment

Leave a Reply

Keep Up to Date with the Most Important News

By pressing the Subscribe button, you confirm that you have read and are agreeing to our Privacy Policy and Terms of Use

Discover more from Dev solutions

Subscribe now to keep reading and get access to the full archive.

Continue reading