Outbound HTTP calls by target host

let lookback = 24h;
dependencies
| where timestamp > ago(lookback)
| where type startswith "http"
| summarize
    calls = sum(itemCount),
    p95_ms = percentilew(duration, itemCount, 95),
    failed = sumif(itemCount, tostring(success) =~ "false"),
    callers = dcount(cloud_RoleName)
    by target
| extend failed_pct = round(100.0 * failed / calls, 2)
| order by calls desc

How it works

Every service has a list of other services it can’t live without, and it is rarely written down. This query writes it down: every host your app calls over HTTP, how often, how fast for the slowest 5% of calls, and how often those calls fail. Run it before a migration, a firewall change or a vendor review, and whenever you want to know what a slow request was waiting on.

Line by line

• where type startswith "http" keeps HTTP dependency calls. The data model gives HTTP as an example of the low-cardinality dependency type; startswith ignores case, so it matches the variants different SDKs write.
• calls = sum(itemCount) counts calls the sampling-aware way.
• p95_ms = percentilew(duration, itemCount, 95) is the duration one call in twenty exceeds, in milliseconds, weighted for sampling.
• failed and failed_pct count failed calls and their share.
• callers = dcount(cloud_RoleName) counts how many of your services call the host. A host with five callers is shared infrastructure; an outage there is felt everywhere.
• by target groups by destination. The data model describes target as the target site of the call, such as a server name or host address. For calls between your own services, target on the caller’s side and source on the callee’s request are the fields Microsoft documents for stitching components together.

Reading the result

The busiest hosts are your critical path. Look for a high p95 on a busy host (worth a cache or a timeout review), failures concentrated on one host, and hosts you didn’t expect, such as a third-party script endpoint called from the server or a test environment’s URL left in production configuration.

For the slowest destinations across all dependency types, use slowest dependencies by target. The correlation and Application Map guide shows how these targets become edges on the map.

Variations

• One host by route: add | where target == "api.example.net" and group by operation_Name instead of target.
• Over time: group by bin(timestamp, 15m), target for the top hosts and add | render timechart.
• Workspace tables: use AppDependencies, TimeGenerated, DependencyType, Target, DurationMs, Success, AppRoleName and ItemCount.