APM Tips

Tool

KQL query builder

Build a latency or volume query for the Application Insights requests, dependencies and pageViews tables without remembering the syntax. Every query counts with sum(itemCount) and weights percentiles for sampling, so the numbers hold up when sampling is on.

Start from a library query

p95 by operation Failure rate timechart Slowest dependencies Exceptions by type Sampling rate in effect Telemetry volume by table
Percentiles of duration

Options a table doesn't have are ignored for that table.

Matches cloud_RoleName exactly, for resources shared by several services.

Your query

let lookback = 24h;
requests
| where timestamp > ago(lookback)
| summarize
    requests = sum(itemCount),
    percentilesw(duration, itemCount, 50, 95, 99)
    by operation_Name
| order by percentile_duration_95 desc

Returns one row per operation_Name for requests in the last 24 hours, with the request count and p50 (median), p95 and p99 duration in milliseconds, weighted for sampling.

What the query does

  • Time range: the first line is let lookback = 24h;, so you change the range in one place. timestamp is UTC, and ago() counts back from now.
  • Counts: sum(itemCount) rather than count(), because each stored row stands for itemCount items when sampling is on.
  • Percentiles: one percentilesw(duration, itemCount, 50, 95, 99) call, the weighted form of percentiles(), so periods sampled more heavily still count at their true size. It names its columns percentile_duration_50, percentile_duration_95 and so on; duration is in milliseconds.
  • Charts: bin(timestamp, …) comes first in the by clause, because a timechart takes its x-axis from the first column.
  • Grouping: only low-cardinality names such as operation_Name or target; never the raw url or id, which make one row per request.
  • Failures: tostring(success) =~ "false", which works whether success is stored as text or as a boolean.

The queries use the table and column names the Application Insights Logs view shows. To run one in the Log Analytics workspace instead, switch to the workspace names: AppRequests, TimeGenerated, DurationMs, ItemCount, OperationName and so on. The KQL library has explained queries for common questions.

Your inputs

The builder assembles the query in your browser and does not send your choices to our server. Standard server logs and analytics still apply, as described in the privacy notice.