An administrator reports that querying telemetry data in Log Analytics for an Azure App Service web application is frequently timing out and exceeding workspace query scan limits.
The `dependencies` table contains the following sample schema and records:
| timestamp | name | target | type | success | duration |
|---|---|---|---|---|---|
| 2026-07-17T12:00:00Z | GET /api/v1/orders | sqlserver.database.windows.net | SQL | true | 120.0 |
| 2026-07-17T13:15:00Z | POST /payment | api.stripe.com | HTTP | false | 2500.0 |
| 2026-07-17T14:30:00Z | GET /user/profile | api.github.com | HTTP | false | 1800.0 |
You need to write an optimized Kusto Query Language (KQL) query that identifies the 95th percentile of the duration of all failed external HTTP dependency calls over the last 24 hours, grouped by the target of the dependency.
Which Kusto Query Language (KQL) query should you use to retrieve the required data while minimizing resource utilization?
- Adependencies
| where success == false and type == "HTTP"
| summarize percentiles(duration, 95) by target - Bdependencies
| where success == false and type == "HTTP"
| summarize percentiles(duration, 95) by target, timestamp
| where timestamp > ago(24h) - dependencies
| where timestamp > ago(24h)
| where success == false and type == "HTTP"
| summarize percentiles(duration, 95) by targetAnswer - Ddependencies
| where success == false and type == "HTTP"
| project target, duration, type
| summarize avg(duration) by target
Answer
The query that filters by timestamp > ago(24h) first, then filters by success and type, and aggregates using percentiles(duration, 95) by target.
The correct query filters the telemetry by timestamp at the very beginning of the pipeline using `where timestamp > ago(24h)`. In Kusto Query Language (KQL), filtering by time range as early as possible is a best practice because it limits the volume of data scanned by the query engine. It then filters for failed HTTP dependencies (`success == false and type == 'HTTP'`) before performing the `summarize percentiles(duration, 95) by target` aggregation, ensuring optimal performance and avoiding query timeouts or scan limit errors.
Step-by-Step Solution
Key Concept
Optimizing KQL queries in Azure Application Insights by placing time-range filters as early as possible in the query pipeline to minimize scanned data volume and avoid query limits.