real world scenario: I need to analyze my alerts distribution by time windows (i.e. how many of them overnight vs during the day) and based on week day (how many on Sunday, Monday, ...)
I think this scenario can be applied to every data source you have. To do that we need to be able to query on parts of the datetime fields.11 votes
I have this capability on my query language improvement backlog already. I would like to allow folks to search via local time (instead of ISO UTC time) and use keywords like Sunday, 6PM, etc.
This is currently behind JOIN, Regex, DEDUP, and search time custom field extraction.
Minify works great for logs. Specifically we would like to get REST endpoints our of the csUriStem8 votes
Add the ability to change a saved search, without having to remember the exact same name and group to override the existing query. At the same time a rename function would be nice.7 votes
Agreed, this seems frustrating. We’re planning on adding this feature.
Can we please have an option to display search results into different types of graphics? Similar to Kusto (or Application Insights Analytics) which has an option to render the search results into different graphics.
| where timestamp >= ago(24h)
| summarize requestCount=count() by client_CountryOrRegion
| order by requestCount desc
| render piechart6 votes
Thanks for the feedback! We have a better visualization for query coming soon
- Don't see your idea?