APM Tips

KQL · dependencies

Dependency p95 duration over time, by type

Chart the p95 duration of outgoing calls per dependency type in 15-minute bins, weighted for sampling, to see which kind of call slowed down and when.

Updated

dependencies dependencies 

let lookback = 24h;
dependencies
| where timestamp > ago(lookback)
| summarize p95_ms = percentilew(duration, itemCount, 95) by bin(timestamp, 15m), type
| order by timestamp asc
| render timechart

Returns: One line per dependency type showing the p95 call duration in milliseconds for each 15-minute interval over the last 24 hours.

Pitfalls

  • A type with very few calls draws a jumpy line: one slow call in an interval is that interval's p95. Filter out low-volume types, or chart only the types you care about.
  • Types group very different targets. One slow database among five fast ones lifts the SQL line only a little; use slowest dependencies by target to separate them.
  • Percentiles are weighted by itemCount, so a change in sampling rate doesn't move the lines on its own.
  • Intervals with no calls produce no point, and the line joins across the gap.

How it works

When the request duration chart jumps, the next question is whether the app got slower or something it calls did. Charting dependency latency by type over the same window answers it in one picture: if the SQL line jumps at the same minute as the request line, start at the database.

Line by line

  • let lookback = 24h; sets the window.
  • percentilew(duration, itemCount, 95) is the p95 call duration in milliseconds, with each stored row weighted by the number of calls it stands for under sampling.
  • by bin(timestamp, 15m), type gives one value per type per 15 minutes. The bin comes first because a timechart takes its x-axis from the first column, which must be a datetime. type is the data model’s low-cardinality dependency type (SQL, HTTP, Azure table and so on), so the chart has a handful of lines rather than hundreds.
  • order by timestamp asc puts the points in time order before drawing.
  • render timechart draws one line per value of type.

Reading the chart

Put it next to the request chart for the same window. A dependency line that moves with the request line is a strong lead. A dependency line that jumps while requests stay flat usually means calls that aren’t on the request’s critical path: background jobs, or calls made in parallel with slower ones. A line that sits exactly at a round number, such as 30,000 ms, is a timeout setting, and the same calls will show as failures in dependency failure rate by type and target.

Which types appear depends on what your SDK or agent instruments. If a client library you rely on is missing from the chart, the agent-based dependency tracking guide explains what each collection method records.

Variations

  • By target instead of type: group by bin(timestamp, 15m), target and add | where type =~ "SQL" to chart each database separately.
  • Call volume instead of latency: replace the percentile with calls = sum(itemCount).
  • Workspace tables: use AppDependencies, TimeGenerated, DependencyType, DurationMs and ItemCount.

Sources, checked

  1. percentilew(), percentilesw() (Kusto)learn.microsoft.com · checked
  2. bin() (Kusto)learn.microsoft.com · checked
  3. render operator (Kusto)learn.microsoft.com · checked
  4. Application Insights telemetry data model (dependency type)learn.microsoft.com · checked
  5. Migrate an Application Insights classic resource to a workspace-based resource (table schemas)learn.microsoft.com · checked

  • Slowest dependencies by target

    dependencies dependencies

    Returns: Up to 20 rows, one per dependency type and target, with the call count, the p95 duration in milliseconds and the number of failed calls, slowest first.

  • Request duration p50 and p95 as a timechart

    requests latency

    Returns: One point per 5-minute interval with the p50 and p95 request duration in milliseconds, drawn as two lines over the last 24 hours.

  • Dependency failure rate by type and target

    dependencies dependencies

    Returns: One row per dependency type and target with at least one failed call, showing total calls, failed calls, the failed percentage and one result code from a failed call.

  • SQL dependency duration by name

    dependencies dependencies

    Returns: One row per SQL target and dependency name with the call count, p50 and p95 duration in milliseconds, failed calls, and the first 200 characters of one command.