``` requests | where resultCode == 500 | join ( exceptions ) on operation_Id | extend pathPrefix = extract("/(\\w+)", 0, tostring(operation_Name)) | summarize count() by outerMessage, pathPrefix | order by count_ desc | where outerMessage contains "ECONNRESET" ```