KQL filter series by max value

user_13131510 0
Viewed 168

I want to make a timechart but my graph is littered by series which have not significant values: enter image description here Is it possible to filter series by:

  1. Taking only a certain number of them with greatest max values
  2. Discarding all series with max value < const

My request is

let Step = timespan(1d);
let PeriodStart = ago(30d);
cluster("").database("").table("")
    | where Timestamp > PeriodStart
    | where Source == "courierapp" and isnotempty(CourierId)
    | summarize by CourierId, bin(Timestamp, Step), AppVersion
    | make-series Version=count() default=0 on Timestamp from PeriodStart to ago(0d) step Step by AppVersion
    | render timechart
kql azure-data-explorer time-series
1 Answers

One possible solution is based on series_stats()

let threshold = 1000;
...  
| make-series Version=count() default=0 on Timestamp from PeriodStart to ago(0d) step Step by AppVersion
| extend series_stats(Version)
| where series_stats_Version_max >= threshold
| render timechart
user_63364790
Related