Explanation (concise): In Azure Sentinel (Microsoft Sentinel) KQL, to display a time chart aggregated by day , you bucket timestamps using bin(TimeGenerated, 1d) (often after a summarize ), which is what the timechart visual expects. extend adds columns, makeset aggregates values into a set, and workspace is for cross-workspace queries-not for time bucketing.