The time series visualisation for queries in data explorer shows blank when I choose the multiple panels option

Question

The time series visualisation for queries in data explorer shows blank when I choose the multiple panels option

Cedric Mélange 20

Following the examples in (https://learn.microsoft.com/en-us/kusto/query/anomaly-detection?view=microsoft-fabric) I'm trying to visualize a decomposition of a time series in Azure Data Explorer. However, when I choose the y-split option, the y-panels show blank

User's image

when I toggle the show multiple panels options, the query is visualised perfectly in a single panel.
User's image

What do I miss to achieve the result from the example as shown below?
Time series decomposition.

Smaran Thoomu 28,225 Reputation points Microsoft External Staff Moderator

2025-08-01T12:46:51.59+00:00

Cedric Mélange We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.
Cedric Mélange 20 Reputation points

2025-08-04T07:48:21.6833333+00:00
@Smaran Thoomu Thank you for your answer! I understand your idea. However I'm experiencing two issue right now:

I don't seem to be able to run your query. I get an error with the project statements in the union clause: "The operator cannot be the first operator in a query".

Due to the mv-expand, I quickly reach my query limit, greatly reducing the granularity of my analysis

Shouldn't the referred example given by Microsoft in https://learn.microsoft.com/en-us/kusto/query/anomaly-detection?view=microsoft-fabric just work?
Smaran Thoomu 28,225 Reputation points Microsoft External Staff Moderator

2025-08-05T17:17:43.05+00:00

Cedric Mélange Just checking in to see if the below answer provided helped. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Accepted answer

0 additional answers

Your answer

Smaran Thoomu 28,225 Reputation points Microsoft External Staff Moderator

2025-08-01T12:46:51.59+00:00

Cedric Mélange We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.
Cedric Mélange 20 Reputation points

2025-08-04T07:48:21.6833333+00:00

@Smaran Thoomu Thank you for your answer! I understand your idea. However I'm experiencing two issue right now:

I don't seem to be able to run your query. I get an error with the project statements in the union clause: "The operator cannot be the first operator in a query".

Due to the mv-expand, I quickly reach my query limit, greatly reducing the granularity of my analysis

Shouldn't the referred example given by Microsoft in https://learn.microsoft.com/en-us/kusto/query/anomaly-detection?view=microsoft-fabric just work?
Smaran Thoomu 28,225 Reputation points Microsoft External Staff Moderator

2025-08-05T17:17:43.05+00:00

Cedric Mélange Just checking in to see if the below answer provided helped. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Answer 1

Smaran Thoomu 28,225 Microsoft External Staff Moderator

Hi Cedric Mélange

Thanks for sharing the screenshots - it’s clear you’ve already got the decomposition logic working, but the issue seems to be with rendering the time series into multiple panels (y-split) as shown in the official example.

Based on what I see, the reason the multiple panels view (with ySplit=panels) renders blank is likely due to missing or mismatched series column values in your result set. Azure Data Explorer expects each decomposed component (like baseline, trend, seasonal, residual) to be represented as separate rows, each with a unique series identifier.

What you're likely missing:

Ensure you're using extend series = in your query to assign the correct labels:

make-series value=avg(SensorValue) on TimeStamp from min_t to max_t step 5m by DeviceId
| extend (baseline, seasonal, trend, residual) = series_decompose(value, -1, 'linefit')
| project TimeStamp, baseline, seasonal, trend, residual
| mv-expand
    baseline, seasonal, trend, residual,
    TimeStamp
| extend value = baseline, series = "baseline"
| union (
    project TimeStamp, value = trend, series = "trend"
),
(
    project TimeStamp, value = seasonal, series = "seasonal"
),
(
    project TimeStamp, value = residual, series = "residual"
)
| render timechart with(title="Temperature, decomposition", ysplit=panels)

Or you can streamline the union into one expression using mv-expand with bag_pack and mv-expand.

Key point:

The charting engine requires a column named series to split each component onto its own panel. Without this, the ySplit option will not behave as expected and panels will appear blank.

Let me know if you need help adjusting your current KQL to match this pattern.

If this resolves your issue, please consider upvote the comment so others in the community can benefit from it as well. Happy to assist further if needed!

Cedric Mélange 20

@Smaran Thoomu Based on your feedback I managed to create the extra series column
with little overhead

let min_t = toscalar(RemoteTimeSeries | summarize min(TimeStamp));
let max_t = toscalar(RemoteTimeSeries | summarize max(TimeStamp));
RemoteTimeSeries
    | make-series value=avg(SensorValue) on TimeStamp from min_t to max_t step 5m by DeviceId
    | extend (baseline, seasonal, trend, residual) = series_decompose(value, -1, 'linefit')
    | project TimeStamp, Pack = bag_pack("value", value, "baseline", baseline, "seasonal", seasonal, "trend", trend, "residual", residual)
    | mv-expand Pack
    | extend series = tostring(bag_keys(Pack)[0])
    | project TimeStamp, series, series_value = Pack[tostring(bag_keys(Pack)[0])]
    | render timechart with(title='Temperature decomposition', ysplit=panels)

now results in a working chart with multiple panes

User's image

To me it feels like unecessary tranformations of the output of time series function. Could it be a bug, as I suspect the referred examples once worked right of the box?

Thanks again for your valuable feedback, based on which I could achieve de desired result.

Smaran Thoomu 28,225 Reputation points Microsoft External Staff Moderator

2025-08-04T14:41:43.7466667+00:00
Hi Cedric Mélange
Thanks a lot for sharing your updated query and confirming that the visualization now works with the ysplit=panels setting - great job working through it!

You're absolutely right - the extra transformations using bag_pack, mv-expand, and series column creation do feel a bit unintuitive, especially when following the official example from the documentation.

To clarify:

The examples in the Microsoft Learn article likely worked as-is at the time they were published.

However, due to internal changes in how the render timechart operator handles multi-series inputs, particularly when using ysplit=panels, the series column has now become a required input to correctly split the components.

So, while it's not necessarily a bug, the current behavior does differ from older versions or what might be implied in the examples.

I'll pass this feedback along internally as well - ideally, the documentation should reflect the latest behavior and recommend the use of the series column for multi-panel charts.

Appreciate your persistence and contribution to improving the community discussion!
I hope this information helps. Please do let us know if you have any further queries.

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Share via

The time series visualisation for queries in data explorer shows blank when I choose the multiple panels option

0 additional answers

Your answer