Azure log analytics timechart with multiple dimensions Azure log analytics timechart with multiple dimensions azure azure

Azure log analytics timechart with multiple dimensions


I though that if multiple dimensions are not really accepted a string concatenation would do the trick. A bit hackish in my opinion but it did.

Perf| where (CounterName == "Bytes Received/sec" or CounterName == "Bytes Sent/sec") and InstanceName matches regex "^Microsoft Hyper-V Network Adapter.*$"| summarize avg(CounterValue) by strcat(Computer, " ", CounterName), bin(TimeGenerated, 10s)| render timechart


Another option is this

let RuntimeID = CosmosThroughput_CL | where MetricName_s == "ProvisionedThroughput" and TimeGenerated between (ago(2h) .. ago(1h))| order by TimeGenerated desc  | top 1 by TimeGenerated| distinct RuntimeID_g;CosmosThroughput_CL | where MetricName_s == "ProvisionedThroughput" and RuntimeID_g in (RuntimeID)| project Resource = toupper(Resource), Value = Throughput_d, Container = Container_s, Database = Database_s, MetricName = "Provisioned"| union     (        AzureDiagnostics         | where ResourceProvider == "MICROSOFT.DOCUMENTDB" and Category == "PartitionKeyRUConsumption"        | where TimeGenerated between (ago(1d) .. ago(1d-1h))        | summarize Value = sum(todouble(requestCharge_s)) by Resource, databaseName_s, collectionName_s        | project Resource, Container = collectionName_s, Database = databaseName_s, Value, MetricName = "HourlyUsage"    ) | union     (         AzureDiagnostics         | where ResourceProvider == "MICROSOFT.DOCUMENTDB" and Category == "PartitionKeyRUConsumption"        | where TimeGenerated between (ago(1d) .. ago(1d-1h))        | summarize Value = sum(todouble(requestCharge_s)/3600) by Resource, databaseName_s, collectionName_s        | project Resource, Container = collectionName_s, Database = databaseName_s, Value, MetricName = "RUs"    )| project Resource, Database, Container, Value, MetricName

The important part is to project the same column names. Value holds the different values from each table. Second union helps me project another value from the same table.