johnciocoiu

requests
| project timestamp, operation_Id, operation_Name, resultCode, url, client_IP, success
| join (
    traces
    | project timestamp, operation_Id, message
    )
    on operation_Id
| where resultCode startswith "4" or resultCode startswith "5" or success == False
| summarize Traces = make_list(message), Time = max(timestamp) by resultCode, operation_Name, operation_Id, url, client_IP, success
| project Time, operation_Name, resultCode, success, Traces, operation_Id, client_IP, url