Kusto for sliding window

Solution 1:

Here is another option using time series functions:

let dt = 1s;
let n_bins = tolong(15m/dt);
let coeffs = repeat(1, n_bins);
let T = view(M:string) {
    range Timestamp from datetime(2022-01-11) to datetime(2022-01-11 01:00) step dt
    | extend machine = M
    | extend status = iif(rand()<0.002, 0, 1)
};
union T("A"), T("B")
| make-series status=any(status) on Timestamp step dt by machine
| extend rolling_status = series_fir(status, coeffs, false)
| extend alerts = series_equals(rolling_status, n_bins)
| project machine, Timestamp, alerts
| mv-expand Timestamp to typeof(datetime), alerts to typeof(bool)
| where alerts == 1

You can also do it using the scan operator.

thanks Adi