KQL Search

let lookback = 7d;
let recentWindow = 1h;
let perHour =
    AppDependencies
    | where TimeGenerated > ago(lookback)
    | where isnotempty(Properties["gen_ai.agent.name"])
    | extend
        Agent  = tostring(Properties["gen_ai.agent.name"]),
        Model  = tostring(Properties["gen_ai.request.model"]),
        InTok  = tolong(Properties["gen_ai.usage.input_tokens"]),
        OutTok = tolong(Properties["gen_ai.usage.output_tokens"])
    | extend TotalTok = coalesce(InTok, 0) + coalesce(OutTok, 0)
    | summarize
        HourTokens = sum(TotalTok),
        HourRuns   = count(),
        AnyModel   = take_any(Model)
        by Agent, Hour = bin(TimeGenerated, 1h);
let baseline =
    perHour
    | where Hour < bin(now(), 1h) - recentWindow
    | summarize
        MedianHourTokens = percentile(HourTokens, 50),
        P95HourTokens    = percentile(HourTokens, 95)
        by Agent;
let recent =
    perHour
    | where Hour >= bin(now(), 1h) - recentWindow;
recent
| join kind=leftouter baseline on Agent
| extend
    MedianHourTokens = coalesce(todouble(MedianHourTokens), 0.0),
    P95HourTokens    = coalesce(todouble(P95HourTokens), 0.0)
| extend SpikeRatio = iff(MedianHourTokens > 0, todouble(HourTokens) / MedianHourTokens, todouble(HourTokens))
| where HourTokens > 50000
    and (SpikeRatio >= 3.0 or HourTokens > P95HourTokens * 2)
| extend AccountName = iff(isempty(Agent), "unknown-agent", Agent)
| extend Model = AnyModel
| project
    Hour, AccountName, Agent, Model, HourRuns, HourTokens,
    MedianHourTokens, P95HourTokens, SpikeRatio
| order by SpikeRatio desc