total_throttled_requests.kql

// Displays the total number of throttled requests over a period of time. Supply a start and end time for the query range and update the cluster uri with the appropriate values from your terraform deployment.

let startTime = todatetime(<QUERY_START_TIME>);
let endTime =  todatetime(<QUERY_END_TIME>);
cluster("https://ade.loganalytics.io/subscriptions/<SUBSCRIPTION_ID>/resourcegroups/<BASE_NAME>-rg/providers/microsoft.operationalinsights/workspaces/<BASE_NAME>loganalytics").database("<BASE_NAME>loganalytics").AzureDiagnostics
| where TimeGenerated between (startTime .. endTime)
| where ResourceProvider == "MICROSOFT.DOCUMENTDB"
| where Category == "DataPlaneRequests" and toint(statusCode_s) == 429
| summarize throttledRequests = count()