I need past 24 hrs and past 7 days of each day count and past 30 days of each day count which is having azure in message column.
Past 24hrs query:
| where message has "azure"
| where timestamp > ago(24h)
| summarize count() by message = "azure"
Past 7days of each day count query:
| where message has "azure"
| where timestamp >= startofday(ago(7d))
| where timestamp < startofday(now())
| summarize count() by startofday(timestamp) , message ="azure"
Past 30days of each day count query:
| where message has "azure"
| where timestamp >= 'startofday'(ago(30d))`enter code here`
| where timestamp < `startofday'(now())
| summarize count() by startofday(timestamp) , message = "azure"
Can we combine these 3 queries and make output result as single? Sample data:
| Timestamp | message |
|---|---|
| 2009-09-17 12:45:37 | Azure |
| 2009-09-18 12:45:39 | Aws |
| 2009-09-29 13:29:12 | |
| 2009-09-12 13:29:14 | Aws |
| 2009-09-19 13:29:17 | Azure |
| 2009-09-14 13:29:23 |
Expected output:
| Timestamp | message | count_24hrs | count_7days | count_30days |
|---|---|---|---|---|
| 2009-09-16 12:45:37 | Azure | 152 | 152 | 152 |
| 2009-09-15 12:45:39 | Azure | 65 | 65 | |
| 2009-09-14 13:29:12 | Azure | 6587 | 6587 | |
| 2009-09-13 13:29:14 | Azure | 98 | 98 | |
| 2009-09-12 13:29:17 | Azure | 54365 | 54365 | |
| 2009-09-11 13:29:23 | Azure | 12 | 12 | |
| 97 | 97 | |||
| 987 | ||||
| 98 |
... Up to past 30days