level != null and ("{{var-service}}" == "" or resource.service.name == "{{var-service}}")
| summarize count() by bin_auto(timestamp), level
| order by timestamp desc
| limit 10000

WITH service_stats AS (
  SELECT resource___service___name, COUNT(*) as error_count
  FROM otel_logs_and_spans
  WHERE project_id='{{project_id}}' AND level IN ('ERROR', 'FATAL')
    AND ('{{var-service}}' = '' OR resource___service___name = '{{var-service}}')
    {{time_filter}}
  GROUP BY resource___service___name
  ORDER BY error_count DESC
  LIMIT 10
)
SELECT
  extract(epoch from time_bucket('{{rollup_interval}}', timestamp))::integer AS time,
  o.resource___service___name as service_name,
  COUNT(*)::float as count
FROM otel_logs_and_spans o
INNER JOIN service_stats s ON o.resource___service___name = s.resource___service___name
WHERE o.project_id='{{project_id}}' AND o.level IN ('ERROR', 'FATAL')
  AND ('{{var-service}}' = '' OR o.resource___service___name = '{{var-service}}')
  {{time_filter}}
GROUP BY time, service_name
ORDER BY time DESC