KQL query library

Returns: One row per operation with its request count, the satisfied, tolerating and frustrated counts against the target, and a 0-to-1 score, worst first.

Returns: One row per availability test and test location with the number of runs, the failed runs, the availability percentage and the p95 test duration in milliseconds, worst first.

Returns: Up to 100 failed availability test runs from the last 24 hours, newest first, each with the test name, location, duration in milliseconds, failure message and operation_Id.

Returns: One row per service and application version with its sampling-adjusted request count, the number and names of instances that served it, and when it was first and last seen in the window.

Returns: Two lines per instance over the last 24 hours in 5-minute steps, the process CPU divided by the processor count and the machine's available memory in gigabytes.

Returns: One line per custom event name for the ten most frequent events, showing the sampling-adjusted count in each hour of the last 7 days.

Returns: One point per UTC day for the last 30 complete days with the number of distinct user IDs and distinct session IDs seen on requests and page views.

Returns: One row per request operation with its request count, the dependency calls made under that operation name and the average calls per request, chattiest first.

Returns: One row per dependency type and target with at least one failed call, showing total calls, failed calls, the failed percentage and one result code from a failed call.

Returns: One line per dependency type showing the p95 call duration in milliseconds for each 15-minute interval over the last 24 hours.

Returns: Every telemetry item recorded with the given operation_Id in the last 7 days, oldest first, with its type, service, name or message, duration, outcome, severity, and the IDs that link parent and child.

Returns: One row for the problem ID with its sampling-adjusted count, first and last time seen, up to ten operations, roles and versions, the number of distinct users and up to five distinct messages.

Returns: Up to 50 rows, one per exception type and operation, with the sampling-adjusted count, the number of distinct problem IDs, one outer message and one innermost exception type.

Returns: One row per result code among failed requests, with the sampling-adjusted failure count, the number of distinct operations affected and one example operation.

Returns: One row per problem ID, operation and result code among failed requests, with the sampling-adjusted exception count, how many failed operations it appeared in, and an example exception type and message.

Returns: One line per operation for the five operations with the most failed requests, showing the percentage of its requests that failed in each 15-minute interval.

Returns: One row per exception type seen in the last 7 days but not in the 28 days before, with its count, the time it first appeared, how many operations threw it, and an example.

Returns: Up to 25 rows, one per message prefix and severity level, with the sampling-adjusted number of trace items, their billed megabytes and the services that wrote them, most expensive first.

Returns: One row per outbound HTTP target with its call count, p95 duration in milliseconds, failed calls and percentage, and how many of your services call it, busiest first.

Returns: Up to 50 rows, one per page name and country or region, with the sampling-adjusted page view count and the number of distinct users, most viewed first.

Returns: One point per 5-minute interval with the p50 and p95 request duration in milliseconds, drawn as two lines over the last 24 hours.

Returns: One row per cloud role name with its request count and its p50, p95 and p99 duration in milliseconds, slowest p95 first.

Returns: One row per operation name with its request count and its p50, p95 and p99 duration in milliseconds, slowest p95 first.

Returns: One row per client country or region with its sampling-adjusted request count, its share of all non-synthetic requests and its p95 server duration in milliseconds.

Returns: One row per operation, 2xx result code and cloud role among requests recorded as failed, with the sampling-adjusted count and one operation_Id to inspect.

Returns: One column per day for the last 14 complete days (UTC), split by cloud role name, showing each service's sampling-adjusted request count.

Returns: One row per operation that had at least one request over the threshold, with its total requests, the number over the threshold and that number as a percentage.

Returns: One row per telemetry type with the rows stored, the items they stand for, and the percentage of items kept by sampling over the last 24 hours.

Returns: One row per hour that had HTTP errors, with the number of 5xx and 4xx responses and up to five operations that returned a 5xx in that hour.

Returns: Up to 20 rows, one per dependency type and target, with the call count, the p95 duration in milliseconds and the number of failed calls, slowest first.

Returns: One row per SQL target and dependency name with the call count, p50 and p95 duration in milliseconds, failed calls, and the first 200 characters of one command.

Returns: One row per table with the billed gigabytes over the last 7 complete days, the stored rows, the items they stand for after sampling, and the average gigabytes per day, largest first.

Returns: Up to 20 individual requests from the last hour, slowest first, each with its operation name, duration in milliseconds, result code, cloud role and instance, and the operation_Id that opens its trace.

Returns: Up to 20 operations with the most failed requests in the last 7 days, each with last week's failures, the change in count and percent, and this week's total requests.

Returns: One row per handledAt value and request outcome, with the sampling-adjusted exception count, the number of distinct exception types and one example type.