Time pivot

  • Article

Applies to: ✅ Azure Data Explorer ✅ Azure Monitor ✅ Microsoft Sentinel

The time pivot visualization is an interactive navigation over the events time-line pivoting on time axis.

Note

  • This visualization can only be used in the context of the render operator.
  • This visualization can be used in Kusto.Explorer but is not available in the Azure Data Explorer web UI.

Syntax

T | render timepivot [with (propertyName = propertyValue [, ...])]

Learn more about syntax conventions.

Parameters

Name Type Required Description
T string ✔️ Input table name.
propertyName, propertyValue string A comma-separated list of key-value property pairs. See supported properties.

Supported properties

All properties are optional.

PropertyName PropertyValue
accumulate Whether the value of each measure gets added to all its predecessors. (true or false)
legend Whether to display a legend or not (visible or hidden).
series Comma-delimited list of columns whose combined per-record values define the series that record belongs to.
ymin The minimum value to be displayed on Y-axis.
ymax The maximum value to be displayed on Y-axis.
title The title of the visualization (of type string).
xaxis How to scale the x-axis (linear or log).
xcolumn Which column in the result is used for the x-axis.
xtitle The title of the x-axis (of type string).
yaxis How to scale the y-axis (linear or log).
ycolumns Comma-delimited list of columns that consist of the values provided per value of the x column.
ytitle The title of the y-axis (of type string).

Example

let midwesternStates = dynamic([
    "ILLINOIS", "INDIANA", "IOWA", "KANSAS", "MICHIGAN", "MINNESOTA",
    "MISSOURI", "NEBRASKA", "NORTH DAKOTA", "OHIO", "SOUTH DAKOTA", "WISCONSIN"
]);
StormEvents
| where EventType == "Flood" and State in (midwesternStates)
| render timepivot with (xcolumn=State)

Screenshot of timepivot in Kusto.Explorer.