Which KQL query returns the 95th-percentile request duration for each operation over the last hour?
- A
requests | where timestamp > ago(1h) | summarize percentile(duration, 95) by operation_Name(correct answer) - B
requests | where timestamp > ago(1h) | project percentile(duration, 95) - C
requests | summarize avg(duration) by operation_Name | where timestamp > ago(1h) - D
traces | where timestamp > ago(1h) | top 95 by duration
Shortcut: KQL: filter with where first, then summarize <aggregation>() by <column>. project can't aggregate, filtering after summarize fails because timestamp is no longer a column, and top 95 returns 95 rows rather than a percentile.
Aggregations such as
percentile() belong in summarize, and by operation_Name groups the result per operation. project can't aggregate, filtering after summarize fails because timestamp is no longer a column, and top 95 returns 95 rows rather than a percentile.