Forum Discussion
Perf counter
Hi Sunil, you didn't give a whole lot to go on, so I made some assumptions. This will get the % of memory in use over the last 24 hours bin by 1 hour and join it with CPU over the last 24 hours also bin by 24 hours.
//get % of memory last 24 hours bin time generated 1 hour
let AvgMem = Perf
| where ObjectName == "Memory"
and CounterName == "% Committed Bytes In Use"
and TimeGenerated < now(24h)
| summarize avg(CounterValue) by bin(TimeGenerated, 1h), Computer
| project AvgMemory=avg_CounterValue, Computer, TimeGenerated;
//end memory
//get % of CPU used 24 hours bin time generated 1 hour
let CPU = Perf
| where ObjectName == "Processor"
and InstanceName == "_Total"
and TimeGenerated < now(24h)
| summarize avg(CounterValue) by bin(TimeGenerated, 1h), Computer
| project AvgCPU = avg_CounterValue, Computer, TimeGenerated;
//end cpu
//Join CPU query with AvgMem query on Computer name column
CPU | join (AvgMem) on Computer
| project Computer, AvgCPU, AvgMemory, TimeGenerated
if you find you don't the counters i've used or you want to try different ones you can use the below to find out what counters you currently have in your environment.
Perf | distinct ObjectName, CounterName
A more concise way to express the same thing without needing to join.
Perf
| where (ObjectName == "Memory" and CounterName == "% Committed Bytes In Use")
or (ObjectName == "Processor" and CounterName == "% Processor Time" and InstanceName == "_Total")
and TimeGenerated < now(24h)
| summarize avg(CounterValue) by bin(TimeGenerated, 1h), Computer, ObjectName
| evaluate pivot(ObjectName, avg(avg_CounterValue))
| project TimeGenerated, Computer, Processor, Memory
nice, I knew there had to be a way to summarize multiple values in the same perf query, thanks! and evaluate pivot has been on my short list to understand better. Thanks for that, two birds, one stone.