Forum Discussion
SebasL
Oct 05, 2020Copper Contributor
Getting the rank of a CounterValue
I'm having issues designing a query in Log Analytics. My goal is to get the computer's CPU rank out of 100 by comparing it to other LogAnalytics computers.
let CPUavgOfMyComputer = Perf
| where Computer contains "myComputerName"
| where ObjectName == 'Processor' and CounterName == '% Processor Time' and InstanceName == '_Total'
| summarize avg(CounterValue);
Perf
| where ObjectName == 'Processor' and CounterName == '% Processor Time' and InstanceName == '_Total'
| summarize tdigestRes = tdigest(CounterValue), count()
| project rank_tdigest(tdigestRes, CPUavgOfMyComputer) * 100.0 / count_
I'm pretty sure my issue comes from my syntax on the rank_tdigest function (TDigest, Expr).
Can we use a variable for Expr ?
It was asking for a scalar expression, like this:
let CPUavgOfMyComputer = toscalar(Perf | where Computer has "name here" | where ObjectName == 'Processor' and CounterName == '% Processor Time' and InstanceName == '_Total' | summarize avg(CounterValue)); Perf | where ObjectName == 'Processor' and CounterName == '% Processor Time' and InstanceName == '_Total' | summarize tdigestRes = tdigest(CounterValue), count() | project rank_tdigest(tdigestRes, CPUavgOfMyComputer) * 100.0 / count_
- CliveWatson
Microsoft
It was asking for a scalar expression, like this:
let CPUavgOfMyComputer = toscalar(Perf | where Computer has "name here" | where ObjectName == 'Processor' and CounterName == '% Processor Time' and InstanceName == '_Total' | summarize avg(CounterValue)); Perf | where ObjectName == 'Processor' and CounterName == '% Processor Time' and InstanceName == '_Total' | summarize tdigestRes = tdigest(CounterValue), count() | project rank_tdigest(tdigestRes, CPUavgOfMyComputer) * 100.0 / count_
- SebasLCopper Contributor