// PB-RAG-08-03 step 1: hourly zero-result rate and p95 duration per index.
// Run in the Log Analytics workspace that receives the search service's resource logs.
// Compare the last 24 hours with the days before the suspected change.
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.SEARCH" and OperationName == "Query.Search"
| where TimeGenerated > ago(7d)
| summarize queries = count(),
            zero_results = countif(Documents_d == 0),
            p95_ms = percentile(DurationMs, 95)
    by bin(TimeGenerated, 1h), IndexName_s
| extend zero_rate_pct = round(100.0 * zero_results / queries, 2)
| order by TimeGenerated desc

// Second query (run on its own): the most frequent zero-result queries in the last 24 hours.
// Query_s holds the query parameters, so it shows filters as well as the search text.
// AzureDiagnostics
// | where ResourceProvider == "MICROSOFT.SEARCH" and OperationName == "Query.Search"
// | where TimeGenerated > ago(24h) and Documents_d == 0
// | summarize hits = count() by IndexName_s, Query_s
// | top 20 by hits