Latency For A Log Analytics Example With Rolling Percentiles
Query
let latencyCachedData = materialize(SigninLogs
| where TimeGenerated > ago(24h)
| project TimeGenerated, IngestionLatency = (_TimeReceived - TimeGenerated)
| extend IngestionLatencyInMinutes = (IngestionLatency / 1m));
union
(latencyCachedData
| evaluate rolling_percentile(IngestionLatencyInMinutes, 95, TimeGenerated, 15m, 5)
| extend pcnt=95),
(latencyCachedData
| evaluate rolling_percentile(IngestionLatencyInMinutes, 99, TimeGenerated, 15m, 5)
| extend pcnt=99)Explanation
The query calculates the ingestion latency for sign-in logs in the past 24 hours. It then calculates the 95th and 99th percentile of the ingestion latency over a rolling 15-minute window with a 5-minute interval.
Details
Rod Trent
Released: March 26, 2020
Tables
SigninLogs
Keywords
SigninLogsTimeGeneratedIngestionLatency_TimeReceivedIngestionLatencyInMinutes
Operators
materializewhereprojectextendunionevaluaterolling_percentile