You need to use totring()
Event
| where TimeGenerated >= ago(7d)
| summarize count() by bin (TimeGenerated, 1d), tostring(EventID)
| render columnchart
This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
I can get the result I'm looking for when it's in table form but looks very wrong when I switch to the Chart view. Rather than trying to explain things here, I'll share a screenshot. I'm expecting to see how many of each Event ID occurred per day. What I'm seeing is very different.
p.s. The tag below is not relevant because there's no tag that is appropriate.
You need to use totring()
Event
| where TimeGenerated >= ago(7d)
| summarize count() by bin (TimeGenerated, 1d), tostring(EventID)
| render columnchart
The answer is the following:
SecurityEvent
| project TimeGenerated, EventID=tostring(EventID)
| where TimeGenerated >= ago(7d)
| summarize Count=count() by EventID, bin(TimeGenerated, 6h)