KQL · operations
Cloud role instances and versions seen per role
For each service, the instances and application versions that sent requests in the last 24 hours, with traffic per version and when each was last seen.
requests operations
let lookback = 24h;
requests
| where timestamp > ago(lookback)
| summarize
requests = sum(itemCount),
instances = dcount(cloud_RoleInstance),
instance_names = make_set(cloud_RoleInstance, 20),
first_seen = min(timestamp),
last_seen = max(timestamp)
by cloud_RoleName, application_Version
| order by cloud_RoleName asc, last_seen descReturns: One row per service and application version with its sampling-adjusted request count, the number and names of instances that served it, and when it was first and last seen in the window.
Pitfalls
- application_Version is empty unless your build or SDK sets it. An empty version column means nobody set it, not that the version is unknown to the app.
- Two versions with recent last_seen times for the same role mean both are serving traffic: a rollout in progress, a deployment slot taking traffic, or an instance that missed the update.
- Instance names on platforms that replace instances (containers, autoscaled hosts) change often; a long instance list is normal there.
- make_set() shows at most the number of names you ask for. Raise the 20 for large fleets, or rely on the instances count.
How it works
“Which version is running where?” sounds like a question for the deployment tool, but the deployment tool tells you what you shipped, not what is answering requests. This query reads the answer from the telemetry itself: for each service, which versions served traffic, on how many instances, and until when.
Line by line
let lookback = 24h;sets the window. Shorten it to1hduring a rollout to see the current state.requests = sum(itemCount)counts the traffic each version served, sampling-adjusted.instances = dcount(cloud_RoleInstance)counts distinct instances, andmake_set(cloud_RoleInstance, 20)lists up to 20 of their names. Microsoft’s Application Map documentation describes the role instance as the way to tell whether an issue affects all servers of a component or only some.first_seenandlast_seenbracket each version in the window. A version whoselast_seenis an hour ago has been replaced; one whosefirst_seenis ten minutes ago has just arrived.by cloud_RoleName, application_Versiongives one row per service and version.order by cloud_RoleName asc, last_seen descgroups rows by service, newest version first.
When to use it
During and after a rollout, to confirm every instance picked up the new version. During an incident, to check whether the failing requests all come from one version: add failed = sumif(itemCount, tostring(success) =~ "false") to the summarize and compare the versions side by side. And as a sanity check of your telemetry setup: a role with no version, or one instance named after a build agent, tells you something is set wrong.
The version only appears if something sets it. The version and build information guide shows how to set application_Version in the classic SDK and with OpenTelemetry, and the correlation and Application Map guide covers role names and instances.
Variations
- Per instance health: group by
cloud_RoleName, cloud_RoleInstanceand add a weighted p95 ofdurationto find one slow machine; performance counters then shows its CPU and memory. - All telemetry, not just requests: use
union requests, dependencies, tracesto include services that only send logs or dependency calls. - Workspace tables: use
AppRequests,TimeGenerated,AppRoleName,AppRoleInstance,AppVersionandItemCount.