otel_histogram_percentile

Combines otel_histogram_merge + percentile extraction in a single step. Works in both summarize and make-series. Input is a dynamic propertybag containing histogram fields (e.g. $raw). The percentile parameter defaults to 50 if omitted.

Temporality-aware (#3429): when the input rows carry aggregation_temporality, CUMULATIVE histogram snapshots are delta-converted before the percentile is computed. Series are detected via metric_hash, so a group holding many series (the usual multi-pod dashboard bin) is handled correctly: each series' first snapshot is subtracted from its last, a restarted epoch (start_time change) counts in full — mirroring otel_rate — and the per-series window deltas merge. The result is the per-window distribution, so percentiles binned over time vary per bin instead of freezing at the lifetime-to-date values. DELTA rows, and inputs with no temporality fields (plain histogram bags), merge directly as before.

A percentile the data does not define is null, which is KQL's value for "no result" and what isnotnull filters (#4985). That covers an empty group, a group mixing both temporalities, CUMULATIVE rows missing timestamp/start_time, and a bin holding only one snapshot of a series — a single lifetime snapshot defines no window, so keep bins at least two export intervals wide (otel_sample_interval measures that interval). ADX reports null for an undefined percentile too. Only the unmergeable cases also raise an AggregateDegraded warning; a plain gap is silent.

For the lifetime-to-date distribution use otel_histogram_merge plus the scalar otel_histogram_percentile.

Variadic form mirrors KQL's percentiles(col, P1, P2, ...): a single call emits one column per requested percentile. Default column names follow Microsoft Kusto: percentile_<col>_<p>. A single alias only renames the first output; tuple assignment names every output explicitly. The plural alias otel_histogram_percentiles is provided for parity with KQL.

| summarize otel_histogram_percentile($raw, 50, 95, 99) by bin(timestamp, 1m)
// → percentile___raw_50, percentile___raw_95, percentile___raw_99
| summarize (p50, p95, p99) = otel_histogram_percentile($raw, 50, 95, 99)
// → p50, p95, p99

Over $raw this is itself an aggregate: use it directly as a summarize/make-series output — never nested inside another aggregate such as avg(...) or sum(...). The scalar form (over an already-merged histogram from otel_histogram_merge) is the one place it appears outside summarize, in a later extend.

(bzrk extension)

Syntax

otel_histogram_percentile(histogram)

Parameters

Returns: real

Syntax

otel_histogram_percentile(histogram, percentile)

Parameters

Returns: real

Syntax

otel_histogram_percentile(histogram, percentile)

Parameters

Returns: dynamic

Examples

Example 1

OtelMetrics
| where metric_type == "histogram"
| summarize p99 = otel_histogram_percentile($raw, 99) by bin(timestamp, 1h)

Example 2

OtelMetrics
| where metric_type == "histogram"
| summarize (p50, p95, p99) = otel_histogram_percentile($raw, 50, 95, 99)
  by bin(timestamp, 1h)

Example 3

OtelMetrics
| where metric_type == "histogram"
| make-series p99 = otel_histogram_percentile($raw, 99) on timestamp
  from datetime(2024-01-01) to datetime(2024-01-02) step 1h