azurekql

Bin producing unexpected results


I use container insights and the following query shows an even chart:

ContainerLogV2
| summarize count() by bin(TimeGenerated, 10m)

barchar with logcount

But when I want to group it by Computer, I suddenly see gaps:

ContainerLogV2
| summarize count() by bin(TimeGenerated, 10m), Computer

barchar with logcount grouped by computer

Is my query wrong?


Solution

  • I have seen similar behaviour. In my case the number of results was limited. By default the log analytics workspace seem to be limited to 1000 results.

    Screenshot of log analytics workspace with limit parameter opened

    Haven you tried increasing the results limit?