azureazure-application-insightskqlazure-monitor-workbooks

How do I create an Azure workbook that accepts a time range in UTC?


I am creating an Azure Workbook to query some data in App Insights and I need it to accept a time range parameter in which you can enter custom start and end dates for the query in UTC. I also then need to display this data in UTC, so that the query results are the same regardless of where in the world the data is being queried.

There does not seem to be any Microsoft documentation that I can find to explain whether you can set this time range to be treated as local time or UTC. My current implementation appears to only treat the time range as local time. This causes issues when querying the data, as it appears to convert any datetimes to UTC before querying, then converts the data back to local time, so the resulting timestamps are misleading for the purpose of the workbook.

Here is the time range parameter I'm using to create the time range parameter in the workbook: enter image description here

...
"content": {
  "version": "KqlParameterItem/1.0",
  "parameters": [
    {
      "id": "ad71f14d-05e5-47d3-9d8a-79ebc1e0fab7",
      "version": "KqlParameterItem/1.0",
      "name": "TimeRange",
      "type": 4,
      "isRequired": true,
      "typeSettings": {
        "selectableValues": [],
        "allowCustom": true
      }
}
...

I have this simple app insights query in the workbook to debug the issue which uses this time range. enter image description here

As you can see in this, our logs are stored in UTC. enter image description here

How can this time range parameter be amended so that it treats any custom datetimes as UTC rather than local time? If this is not possible, is there any best way to convert the time range type to UTC without actually changing the represented datetime before executing the query? Any help would be appreciated.


Solution

  • How can this time range parameter be amended so that it treats any custom datetimes as UTC rather than local time?

    Use the following Kusto Query Language (KQL) to handle the custom time range as UTC.

    let start_time = todatetime(datetime({TimeRange:start}) + 'Z');
    let end_time = todatetime(datetime({TimeRange:end}) + 'Z');
    customEvents
    | where timestamp >= start_time and timestamp <= end_time
    | project timestamp_utc = format_datetime(timestamp, 'yyyy-MM-dd HH:mm:ssZ'), name, customDimensions
    | order by timestamp_utc desc
    

    NOTE: Check that timestamp_utc field is displayed in the table.

    enter image description here

    Complete JSON Configuration for the workbook look like below.

    {
      "version": "Notebook/1.0",
      "items": [
        {
          "type": "KqlParameterItem",
          "id": "ad71f14d-05e5-47d3-9d8a-79ebc1e0fab7",
          "name": "TimeRange",
          "typeSettings": {
            "selectableValues": [],
            "allowCustom": true
          },
          "isRequired": true
        },
        {
          "type": "Query",
          "id": "query1",
          "query": "let start_time = todatetime(datetime({TimeRange:start}) + 'Z'); let end_time = todatetime(datetime({TimeRange:end}) + 'Z'); customEvents | where timestamp >= start_time and timestamp <= end_time | project timestamp_utc = format_datetime(timestamp, 'yyyy-MM-dd HH:mm:ssZ'), name, customDimensions | order by timestamp_utc desc",
          "timeContext": {
            "from": "{TimeRange:start}",
            "to": "{TimeRange:end}"
          },
          "visualization": "table"
        }
      ]
    }