How to Plot Pre-Averaged Time Series Data in KQL Without Using Summarize?

Question

I am currently working on creating a dashboard graph, where my objective is to plot two different series on a timechart. The two series in question are represented by the processingRate and inputRate columns in my dataset.

Each of these series represents rates that have already been averaged over specified time intervals (e.g., every 5 seconds). As a result, the data is already in a form that I want to visualize, and I don't need to aggregate it further.

My challenge is in plotting these pre-averaged rates without applying additional bin-summarization over a time interval, as this would distort the already averaged data.

How can I achieve this and display both series on the same timechart without further time binning or summarization? Any suggestions or insights would be greatly appreciated.

My pseudo code looks like this:

// Join the tables and render the timechart
let AnalysisTbl = InputRateAnalysisTbl
    | join kind=inner ProcessingRateAnalysisTbl on applicationId_s, TimeGenerated
    | project inputRate, processingRate, applicationId_s, TimeGenerated;
AnalysisTbl
| render timechart with x-axis being TimeGenerated and y-axis being inputRate and processingRate

Answer 1

I have managed to find a solution to my problem. The key lay in harmonizing the structure of the InputRateAnalysisTbl and ProcessingRateAnalysisTbl tables and then utilizing the union operator.

Here's how I went about it:

First, I added a new column rateName to each table to tag the rates:

let InputRateAnalysisTbl = SparkMetric_CL
    | where clusterName_s contains "Name"
    | where metric_type_s == "Meter"
    | extend rateName = "inputRate"
    | extend rate = m1_rate_d
    | project rateName,rate, applicationId_s, TimeGenerated, name_s;

Secondly, I mirrored these changes on the ProcessingRateAnalysisTbl:

let ProcessingRateAnalysisTbl = SparkMetric_CL
    | where clusterName_s contains "Name"
    | where metric_type_s == "Meter"
    | extend rateName = "processRate"
    | extend rate = m1_rate_d
    | project rateName, rate, applicationId_s, TimeGenerated, name_s;

Finally, I used union to combine the two tables and then rendered the timechart:

union InputRateAnalysisTbl, ProcessingRateAnalysisTbl
| order by TimeGenerated asc
| render timechart 

Felt a little counter intuitive.