render operator

Instructs the user agent to render a visualization of the query results.

The render operator must be the last operator in the query, and can only be used with queries that produce a single tabular data stream result. The render operator doesn’t modify data. It injects an annotation (“Visualization”) into the result’s extended properties. The annotation contains the information provided by the operator in the query. The interpretation of the visualization information is done by the user agent. Different agents, such as Kusto.Explorer or Azure Data Explorer web UI, may support different visualizations.

The data model of the render operator looks at the tabular data as if it has three kinds of columns:

• The x axis column (indicated by the xcolumn property).

• The series columns (any number of columns indicated by the series property.) For each record, the combined values of these columns define a single series, and the chart has as many series as there are distinct combined values.

• The y axis columns (any number of columns indicated by the ycolumns property). For each record, the series has as many measurements (“points” in the chart) as there are y-axis columns.

  by the query. In particular, having “uninteresting” columns in the schema of the result might translate into them guessing wrong. Try projecting-away such columns when that happens.

Syntax

T | render visualization [with ( propertyName = propertyValue [, …])]

Parameters

Visualization

Supported properties

PropertyName/PropertyValue indicate additional information to use when rendering. All properties are optional. The supported properties are:

kind property

This visualization can be further elaborated by providing the kind property. The supported values of this property are:

ysplit property

Some visualizations support splitting into multiple y-axis values:

How to render continuous data

Several visualizations are used for rendering sequences of values, for example, linechart, timechart, and areachart. These visualizations have the following conceptual model:

• One column in the table represents the x-axis of the data. This column can be explicitly defined using the xcolumn property. If not defined, the user agent picks the first column that is appropriate for the visualization.
  • For example: in the timechart visualization, the user agent uses the first datetime column.
  • If this column is of type dynamic and it holds an array, the individual values in the array will be treated as the values of the x-axis.
• One or more columns in the table represent one or more measures that vary by the x-axis. These columns can be explicitly defined using the ycolumns property. If not defined, the user agent picks all columns that are appropriate for the visualization.
  • For example: in the timechart visualization, the user agent uses all columns with a numeric value that haven’t been specified otherwise.
  • If the x-axis is an array, the values of each y-axis should also be an array of a similar length, with each y-axis occurring in a single column.
• Zero or more columns in the table represent a unique set of dimensions that group together the measures. These columns can be specified by the series property, or the user agent will pick them automatically from the columns that are otherwise unspecified.

Related content

• Add a query visualization in the web UI
• Customize dashboard visuals
• Rendering examples in the tutorial
• Anomaly detection

three kinds of columns: property). For each record, the series has as many measurements (“points” in the chart) as there are y-axis columns.

Example

InsightsMetrics
| where Computer == "DC00.NA.contosohotels.com"
| where Namespace  == "Processor" and Name == "UtilizationPercentage"
| summarize avg(Val) by Computer, bin(TimeGenerated, 1h)
| render timechart