Add Traces.kql file.

KQL/Dependencies.kql

@@ -2,7 +2,7 @@
 // REF: https://docs.microsoft.com/en-us/azure/kusto/query/
 
 dependencies
-| where timestamp > ago(1d)
+| where timestamp > ago(10m)
     and type == "HTTP"
 | summarize targetCount=count() by target, operation_Name
 | order by targetCount desc 
@@ -16,8 +16,11 @@ dependencies
 dependencies
 | where timestamp > ago(20m)
 | order by timestamp desc 
+| extend ago=now() - timestamp
 | project timestamp
+, ago
 , operation_Name 
+, duration 
 , operation_SyntheticSource 
 , target
 , name

KQL/Traces.kql

@@ -0,0 +1,25 @@
+// FILE: Traces.kql
+// REF: https://docs.microsoft.com/en-us/azure/kusto/query/
+
+traces
+| extend ago=timestamp - now()
+| order by timestamp desc 
+| project ago, message, customDimensions, cloud_RoleInstance, client_City
+
+// Is there ANY NEW data?
+
+traces
+| where message startswith "Clone caused miner to reload"
+    and timestamp > ago(3d)
+| extend ago=timestamp - now()
+    , custom=parse_json(customDimensions) 
+| where custom.isNewData == "True"
+| order by timestamp 
+| project ago, message, custom.isNewData, customDimensions, cloud_RoleInstance, client_City 
+
+// Any email sent?
+
+traces
+| where timestamp > ago(7d)
+| search "Sending Email:"
+| limit 10

MooveePicker.sln

@@ -57,6 +57,7 @@ Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "ApplicationInsights", "Appl
 		KQL\Counts.kql = KQL\Counts.kql
 		KQL\Dependencies.kql = KQL\Dependencies.kql
 		KQL\RequestLocations.kql = KQL\RequestLocations.kql
+		KQL\Traces.kql = KQL\Traces.kql
 	EndProjectSection
 EndProject
 Global