tabular value converted to scalar doesn't work in subsequent calculation

Jeremy Hagan 0 Reputation points
2023-03-15T23:57:17.6033333+00:00

Hi,

I am trying to do a percentage of total count per Event ID in the Security Event Table. My query is as follows:

let totalevents = toscalar(SecurityEvent
| summarize count());
SecurityEvent
| summarize count() by EventID
| extend total=totalevents
| extend perc = count_/total

However perc is always zero. What am I doing wrong here?

Azure Monitor
Azure Monitor
An Azure service that is used to collect, analyze, and act on telemetry data from Azure and on-premises environments.
2,786 questions
Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
971 questions

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Clive Watson 5,711 Reputation points MVP
    2023-03-16T10:31:09.5233333+00:00

    Hi, The count value needs to be a double/real
    https://learn.microsoft.com/en-gb/azure/data-explorer/kusto/query/todoublefunction 

    let totalevents = toscalar(SecurityEvent
| summarize count());
SecurityEvent
| summarize count() by EventID
| extend total=totalevents
| extend perc = todouble(count_) / total