I have a device_event table and I’m trying out following query :
device_events
| where orgid = 1
| summarize failedEvents = countif(name=='failure'),
successEvents = countif(name=='success'),
p95EventTime = percentile(toreal(event_time), 95) by orgid
| summarize fallbackCountByCity = countif(name=='fallback') by cityid
But kusto doesn’t allow this. How do I achieve this ? Or do I have to write 2 separate queries for this ?
1
Kusto multiple summarize in single query
Yes, Instead of multiple summarize in single query you need to write two separate queries and join the query results by using join as you can see in the below query.
let Sales = datatable(Region:string, Product:string, Quantity:int, Revenue:double) [
"East", "Product A", 100, 5000.00,
"East", "Product B", 150, 7500.00,
"West", "Product A", 120, 6000.00,
"West", "Product B", 130, 6500.00,
];
let QuantitySummary = Sales
| summarize TotalQuantity = sum(Quantity) by Region;
let RevenueSummary = Sales
| summarize TotalRevenue = sum(Revenue) by Region;
QuantitySummary
| join kind=inner (RevenueSummary) on Region
| project Region, TotalQuantity, TotalRevenue
Output:
Multiple summarize in single query is not supported in kql as you can see below it throws an error:
StormEvents
| where InjuriesDirect > 0
| summarize by EventType
| summarize by State
Output: