How to use the DPE incident dashboard

1. Open the dashboard (DPE-dashboard-fork.html) in your browser.
2. Click Show Kusto query at the top to copy the canonical query, then run it in the Kusto Web UI against icmdataro.centralus.kusto.windows.net / IcMDataWarehouse.
3. In the Kusto result grid: Ctrl+A then Ctrl+C.
4. Paste into the dashboard's text area — rendering is automatic on paste, and the textarea is cleared immediately so the data does not linger in the DOM.
5. Use the filters to narrow the dataset; every chart, KPI, and the table updates live.
6. Use Export ▾ (top) for a full Markdown report, or Export incidents (MD) (above the table) to dump just the filtered rows.

Period

• All loaded — no time filter.
• By year / By month — multi-select list built from the ModifiedDate values present in the data.
• By fiscal quarter — Microsoft fiscal calendar (FY starts July 1). So FY26Q3 = Jan–Mar 2026.
• Custom range — explicit start/end dates (inclusive).

The button label shows All, the single value, or N selected. Empty selection means no period filter.

Transfer rule

• All — no constraint.
• Zero only — routed correctly first time.
• One or more — bounced at least once.
• At least N / Exact N — uses the Count input.

Search

Free-text match across IncidentId, IcMTeam, and every destination team in the transfer set. Useful for pulling a specific case (700966944) or every incident that touched a specific team (expressroute).

Tracked queues

Comma-separated list of team names whose ownership time should be summed into Queue time (defaults to CLOUDNET\EEECloudnetSev2, CLOUDNET\NetworkingNinjas). Comparison is case-insensitive and tolerant of escaped backslashes (\\) and surrounding quotes from the JSON-style TransferSet. Editing this field recomputes the Queue time column and KPIs immediately.

Severity / IcM team chips (tri-state)

Each chip cycles through three states on click:

• Neutral — chip does not constrain results.
• Include — row must match at least one included chip in this group.
• Exclude — row is dropped if it matches any excluded chip.

Includes and excludes can be mixed across groups, e.g. include Sev 2, Sev 3 while excluding a specific noisy team.

Heatmap selection

Click any tile in Top transfer destinations to constrain the table to incidents whose TransferSet hit that destination at least once. Click again to deselect. Multi-select is supported (OR'd).

For each incident the dashboard walks the TransferSet chronologically. The team in entry i owns the case from entry[i].at until entry[i+1].at. The final segment is capped at MitigateDate → ModifiedDate → "now", whichever is first available. Only segments whose owning team is in the Tracked queues input contribute to QueueHours.

Worked example — transfer set:

2026-03-18T22:25:06Z -> CLOUDNET\EEECLOUDNETSEV2
2026-03-19T00:09:22Z -> CLOUDNET\EXPRESSROUTESUPPORT
2026-03-19T00:11:10Z -> CLOUDNET\EEECLOUDNETSEV2
2026-03-19T00:11:33Z -> CLOUDNET\EXPRESSROUTESUPPORT

With the default tracked queue CLOUDNET\EEECloudnetSev2:

• 22:25:06 → 00:09:22 on EEECLOUDNETSEV2 = 1.74 h (counted)
• 00:09:22 → 00:11:10 on EXPRESSROUTESUPPORT (not counted)
• 00:11:10 → 00:11:33 on EEECLOUDNETSEV2 = 0.006 h (counted)
• 00:11:33 → MitigateDate on EXPRESSROUTESUPPORT (not counted)

QueueHours ≈ 1.75 h.

Queue time colour dot

Each value in the Queue time (h) column shows a dot comparing the incident to the full-sample mean (with a small ±1% tolerance to avoid flicker):

• Below average
• At average
• Above average

Hover the dot to see the exact comparison.

Compact monthly bar chart bucketed by ModifiedDate (matching the Period filter). The peak month is called out below the chart.

One bar per severity. Bar length = count, percentage = share of the visible set.

Top 10 teams that incidents got transferred into, counted once per incident (so an incident that pings a team three times still counts as 1). Click a tile to filter the rest of the dashboard by that destination; click again to deselect.

One row per IcMTeam (DPE, NIT, etc.). Columns: Share bar, Count (+ % of visible), and avg / p50 / p90 for TTM, TTR, and Transfers per team.

Up to 500 rows. Click any column header to sort (click again to flip direction). The IncidentId is a link to the IcM portal. The Transfer set cell shows the first 5 destinations and a (+N) suffix when truncated. The Queue time (h) column is sortable and shows the green/yellow/red dot described above.

If you need more than 500 rows, use Export incidents (MD) — it includes all matching rows in the same sort order as the table, plus the same Summary KPIs / Severity / Team distribution sections as the main report.

Two Markdown export options are available:

• Export ▾ → Markdown report (top of page) — full report with Summary KPIs, Severity breakdown, Team distribution, and Top 15 transfer destinations. Filename dpe-dashboard-report-YYYYMMDD-HHMM.md.
• Export incidents (MD) (next to the Filtered incidents title) — everything in the main report plus a row-per-incident table with the IncidentId linked to IcM. Transfer-set entries are emitted in chronological order (earliest → latest). Filename dpe-dashboard-incidents-YYYYMMDD-HHMM.md.

Both buttons are disabled until data is loaded and re-disabled by Clear all. Each export header records the active filter scope (period, transfer mode, sev/team include & exclude sets, search, tracked queues) so the file is self-describing.

Incident timings are right-skewed: many fast incidents, a long tail of slow ones. So the three numbers tell different stories.

Worked example — 10 TTRs (hours), sorted: 1, 2, 2, 3, 4, 5, 6, 8, 12, 200

• Mean = 24.3 h ← pulled up by the 200 h outlier.
• p50 = 4.5 h ← what most cases really feel like.
• p90 = 12 h ← the 9th of 10 sorted values.

Rule of thumb: if mean >> p50 you have outliers; if p90 >> p50 you have a long tail worth investigating.

"Show me Sev 2 incidents from FY26Q3 that bounced more than 5 times"

1. Period → By fiscal quarter → click Value → tick FY26Q3
2. Severity chips → click Sev 2 once (becomes Include).
3. Transfer rule → At least, Count = 5

"Hide everything routed to a specific team"

1. IcM team chips → click the team twice (cycles to Exclude).

"Compare DPE-only vs DPE+NIT in queue time"

1. IcM team chips → click DPE once (Include) → check the Total queue time KPI.
2. Click DPE twice more to clear, then click DPE+NIT → compare.

"Which team has the slowest tail?"

1. Clear all filters.
2. In Team distribution, compare the p90 of TTR across teams.
3. Big delta between p50 and p90 = unpredictable; large p90 alone = consistently slow tail.

• Table is empty after loading. Check the period selector — if it's set to a month with no data, you'll see nothing. Switch to All loaded.
• Queue time is 0 for everyone. The team names in Tracked queues don't match anything in the transfer sets. Names are case-insensitive but must otherwise be exact (mind the CLOUDNET\ prefix).
• Avg TTR looks too low. Open incidents (empty TTR) are excluded from the mean. The slow cases may simply not be done yet.
• Severity 25 (or some other odd value) appears. A row in the source export has misaligned tabs. Inspect the file directly.
• Export button is greyed out. Load data first; both Export buttons enable on Render and disable again on Clear all.