Custom events by name as a timechart

let lookback = 7d;
let topEvents = customEvents
    | where timestamp > ago(lookback)
    | summarize events = sum(itemCount) by name
    | top 10 by events desc
    | project name;
customEvents
| where timestamp > ago(lookback)
| where name in (topEvents)
| summarize events = sum(itemCount) by bin(timestamp, 1h), name
| order by timestamp asc
| render timechart

How it works

Custom events are the business side of telemetry: a sign-up, a checkout, a report export, sent with TrackEvent in the classic SDKs or as an event through OpenTelemetry. Charting them over time is how you find out that checkouts stopped at 14:00 before a customer tells you.

Line by line

• let topEvents = ...; finds the ten event names with the most occurrences in the window and keeps only the name column. Charting every event name produces an unreadable chart.
• where name in (topEvents) keeps those ten.
• events = sum(itemCount) counts occurrences the sampling-aware way. Microsoft’s Classic API documentation makes the point with this table: itemCount 10 means only one of ten calls was kept, so the correct count is sum(itemCount).
• by bin(timestamp, 1h), name gives one count per event per hour; the time bin comes first because the chart takes its x-axis from the first column.
• render timechart draws one line per name.

Summing a custom measurement

Events can carry numbers in customMeasurements, such as an order total. The data model notes that measurements are sampled together with the item they belong to, so weight them by itemCount too:

let lookback = 7d;
customEvents
| where timestamp > ago(lookback)
| where name == "CheckoutCompleted"
| extend order_total = todouble(customMeasurements["OrderTotal"])
| summarize checkouts = sum(itemCount), revenue = sum(order_total * itemCount) by bin(timestamp, 1d)
| order by timestamp asc

Replace the event and measurement names with your own; the keys are whatever your code sent. String values belong in customDimensions, read with tostring(customDimensions["Plan"]).

When to use it

Use it as a business health chart next to the technical ones, and as the basis of an alert on an event that should never stop, such as orders placed. For a value you want to chart independently of events, a metric is the better tool; the custom metrics guide explains the difference. The one-request guide shows how to send a test event and find it here.

Variations

• One event, daily: filter to one name and bin by 1d.
• Workspace tables: use AppEvents, TimeGenerated, Name, Measurements (the classic customMeasurements), Properties (the classic customDimensions) and ItemCount.