Forum Discussion

SebasL's avatar
SebasL
Copper Contributor
Oct 05, 2020

Getting the rank of a CounterValue

I'm having issues designing a query in Log Analytics. My goal is to get the computer's CPU rank out of 100 by comparing it to other LogAnalytics computers.

 

 

let CPUavgOfMyComputer = Perf 
| where Computer contains "myComputerName" 
| where ObjectName == 'Processor' and CounterName == '% Processor Time' and InstanceName == '_Total'
| summarize avg(CounterValue);
Perf
| where ObjectName == 'Processor' and CounterName == '% Processor Time' and InstanceName == '_Total'
| summarize tdigestRes = tdigest(CounterValue), count()
| project rank_tdigest(tdigestRes, CPUavgOfMyComputer) * 100.0 / count_

 

 

I'm pretty sure my issue comes from my syntax on the rank_tdigest function (TDigest, Expr).

 

Can we use a variable for Expr ?

  • SebasL 

     

    It was asking for a scalar expression, like this:

     

    let CPUavgOfMyComputer = toscalar(Perf 
    | where Computer has "name here" 
    | where ObjectName == 'Processor' and CounterName == '% Processor Time' and InstanceName == '_Total'
    | summarize avg(CounterValue));
    Perf
    | where ObjectName == 'Processor' and CounterName == '% Processor Time' and InstanceName == '_Total'
    | summarize tdigestRes = tdigest(CounterValue), count()
    | project rank_tdigest(tdigestRes, CPUavgOfMyComputer) * 100.0 / count_
  • SebasL 

     

    It was asking for a scalar expression, like this:

     

    let CPUavgOfMyComputer = toscalar(Perf 
    | where Computer has "name here" 
    | where ObjectName == 'Processor' and CounterName == '% Processor Time' and InstanceName == '_Total'
    | summarize avg(CounterValue));
    Perf
    | where ObjectName == 'Processor' and CounterName == '% Processor Time' and InstanceName == '_Total'
    | summarize tdigestRes = tdigest(CounterValue), count()
    | project rank_tdigest(tdigestRes, CPUavgOfMyComputer) * 100.0 / count_

Resources