KQL Search

Query Details

HomeAI ToolsDevice Query

Compare Total Recordswith Valueby Percentage

Query

//Compare a count of total records in a table for the last 24h to the count of records in the same table with a specific property value to get a %
//Myself and Brian Barrington were schooled by Clive Watson on this one :)

SigninLogs
| summarize ErrorCount=countif(ResultType == 16000 or ResultType == 50140), TotalCount=countif(isnotempty(ResultType))
| extend percent = ((toreal(ErrorCount) / toreal(TotalCount))*100)

Explanation

This query compares the count of total records in a table for the last 24 hours to the count of records in the same table with a specific property value. It then calculates the percentage of the specific property value records out of the total records.

Details

Rod Trent profile picture

Rod Trent

Released: January 28, 2021

Tables

SigninLogs

Keywords

SigninLogs,ResultType,ErrorCount,TotalCount,percent

Operators

countiforisnotemptysummarizeextendtoreal/*-

Actions