Forum Discussion
Ahmed Atef
Jun 07, 2018Brass Contributor
Azure Monitor Query not working any more arg_max
Hi,
I had an azure monitor query to alert on low disk space on the VMs, i want to modify it, but suddenly the query is not accepted, even if it is the same that was working.
here is the query and you can see in the screenshot the error,
Perf | where ObjectName == "LogicalDisk" and CounterName == "% Free Space" and InstanceName != "_Total" | summarize AggregatedValue=arg_max(CounterValue,TimeGenerated,CounterName) by Computer, InstanceName , bin(TimeGenerated, 15m)
i tried using argmax instead of arg_max but no luck as well.
does anyone know how to get it working again ?
Hi
Azure Log Analytics alerts will not work on aggregating more than one field. In your case you are aggregating by Computer and InstanceName. If you have configured such alert the alert will work by aggregating only the first filed and skip all the others that are not bin(). Basically your alert will not have the desired affect. I would guess they now have implemented this block on UI level to be clear for user of the service.
Hi
Azure Log Analytics alerts will not work on aggregating more than one field. In your case you are aggregating by Computer and InstanceName. If you have configured such alert the alert will work by aggregating only the first filed and skip all the others that are not bin(). Basically your alert will not have the desired affect. I would guess they now have implemented this block on UI level to be clear for user of the service.
- Prashant SharmaBrass Contributor
Hi,
you can try this one.
| where ObjectName == "LogicalDisk" and CounterName == "% Free Space"
| summarize FreeSpace = min(CounterValue) by Computer, InstanceName
| where strlen(InstanceName) ==2 and InstanceName contains ":"
| where FreeSpace < 15
| sort by FreeSpace asc