KQL Search

Query Details

HomeAI ToolsDevice Query

Latency For A Log Analytics Example With Rolling Percentiles

Query

let latencyCachedData = materialize(SigninLogs
| where TimeGenerated > ago(24h)
| project TimeGenerated, IngestionLatency = (_TimeReceived - TimeGenerated)
| extend IngestionLatencyInMinutes = (IngestionLatency / 1m));
union 
(latencyCachedData
| evaluate rolling_percentile(IngestionLatencyInMinutes, 95, TimeGenerated, 15m, 5)
| extend pcnt=95),
(latencyCachedData
| evaluate rolling_percentile(IngestionLatencyInMinutes, 99, TimeGenerated, 15m, 5)
| extend pcnt=99)

Explanation

The query calculates the ingestion latency for sign-in logs in the past 24 hours. It then calculates the 95th and 99th percentile of the ingestion latency over a rolling 15-minute window with a 5-minute interval.

Details

Rod Trent profile picture

Rod Trent

Released: March 26, 2020

Tables

SigninLogs

Keywords

SigninLogs,TimeGenerated,IngestionLatency,_TimeReceived,IngestionLatencyInMinutes

Operators

materializewhereprojectextendunionevaluaterolling_percentile

Actions