Azure Workbook

Question

Hi i have an issue i am enountering. I am tryingto have different ysplit panels in azure but i cant. I used he render qquery but it is like ignore when running. Here is my query

let SHO_CPU =
Perf
| where Computer in (dynamic([{WVDHosts}]))
| where TimeGenerated {Timeline:query}
| where ObjectName == "Processor Information"
| where CounterName == "% Processor Time"
| where InstanceName == "_Total"
| summarize SHO_CPU = avg(CounterValue)
    by bin(TimeGenerated, {Timeline:grain});
 
let FS_CPU =
InsightsMetrics
| where Computer in (dynamic([{WVDHostsFil}]))
| where TimeGenerated {Timeline:query}
| where Namespace == "Processor"
| where Name == "UtilizationPercentage"
| summarize FS_CPU = avg(Val)
    by bin(TimeGenerated, {Timeline:grain});
 
let TenTau_Rows =
cja_from_auto_acocunt_tenthousand_rows_CL
| where Computer in (dynamic([{WVDHostsql}]))
| where TimeGenerated {Timeline:query}
| summarize TenTau_Rows = avg(ExecTimeInt)
    by bin(TimeGenerated, {Timeline:grain});
 
let COMOS_Processes =
VMProcess
| where Computer in (dynamic([{WVDHosts}]))
| where TimeGenerated {Timeline:query}
| where ExecutableName =~ "comos"
| extend ProcessKey = strcat(Computer, "|", tostring(FirstPid))
| summarize COMOS_Processes = dcount(ProcessKey)
    by bin(TimeGenerated, {Timeline:grain});
 
SHO_CPU
| join kind=fullouter FS_CPU on TimeGenerated
| join kind=fullouter TenTau_Rows on TimeGenerated
| join kind=fullouter COMOS_Processes on TimeGenerated
| project
    TimeGenerated,
    SHO_CPU,
    FS_CPU,
    TenTau_Rows,
    COMOS_Processes

Azure documentation talks of ysplit but idk whyits not working in azure workbook. How can i get the visualizationi want

Answer 1

Hi @Tchakounte Tchakounte, Hillary

The issue here is not your KQL. It is a visualization limitation/difference in Azure Workbooks.

ysplit=panels is a valid property of the Kusto render operator:

| render timechart with (

ysplit=panels,

ycolumns=SHO_CPU, FS_CPU, TenTau_Rows, COMOS_Processes

)

However, the render operator only adds visualization metadata to the query result. Microsoft specifically notes that the actual interpretation of this metadata depends on the client/user agent, and different clients can support different visualization properties.

Azure Workbooks uses its own visualization configuration, so ysplit=panels isn't currently honored in the same way as Azure Data Explorer/Kusto visualizations. This is why the query executes successfully but the ysplit setting appears to be ignored.

For Workbooks, I would recommend converting the result into a long/series format:

let SHO_CPU = Perf

| where Computer in (dynamic([{WVDHosts}]))

| where TimeGenerated {Timeline:query}

| where ObjectName == "Processor Information"

| where CounterName == "% Processor Time"

| where InstanceName == "_Total"

| summarize Value = avg(CounterValue)

by TimeGenerated = bin(TimeGenerated, {Timeline:grain})

| extend Metric = "SHO_CPU";

let FS_CPU = InsightsMetrics

| where Computer in (dynamic([{WVDHostsFil}]))

| where TimeGenerated {Timeline:query}

| where Namespace == "Processor"

| where Name == "UtilizationPercentage"

| summarize Value = avg(Val)

by TimeGenerated = bin(TimeGenerated, {Timeline:grain})

| extend Metric = "FS_CPU";

let TenTau_Rows = cja_from_auto_acocunt_tenthousand_rows_CL

| where Computer in (dynamic([{WVDHostsql}]))

| where TimeGenerated {Timeline:query}

| summarize Value = avg(ExecTimeInt)

by TimeGenerated = bin(TimeGenerated, {Timeline:grain})

| extend Metric = "TenTau_Rows";

let COMOS_Processes = VMProcess

| where Computer in (dynamic([{WVDHosts}]))

| where TimeGenerated {Timeline:query}

| where ExecutableName =~ "comos"

| extend ProcessKey = strcat(Computer, "|", tostring(FirstPid))

| summarize Value = todouble(dcount(ProcessKey))

by TimeGenerated = bin(TimeGenerated, {Timeline:grain})

| extend Metric = "COMOS_Processes";

union SHO_CPU, FS_CPU, TenTau_Rows, COMOS_Processes

| project TimeGenerated, Metric, Value

| order by TimeGenerated asc

Then in the Workbook configure the visualization as a Time chart with:

X axis: TimeGenerated

Y axis: Value

Split/Series by: Metric

This gives you four independent series without having to perform the fullouter joins.