Forum Discussion

the_irk's avatar
the_irk
Copper Contributor
Feb 22, 2019
Solved

Render operator ignoring ymin and ymax values

I'm having a problem with the analytics tools, specifically the Analytics inside Application Insights as well as the Logs analytics inside a Log Analytics workspace. Regardless of query or chart type...
Azure Log Analytics
azure monitor
  • chrisbutler's avatar
    chrisbutler
    Oct 01, 2019

    CliveWatson 

     

    Hey Clive,

     

    Yes it is a busy chart, I have extra WHERE statements similar to yours in the Query I'm actually using that filter our a bunch of the disks that I'm not particularly interested in (Azure VM BEK and Temp storage drives especially) however I've left those out of my post as it identifies some of the machine names (and therefore could be extrapolated to the DNS name with enough trial and error).

    The issue with just using:

     

     

    | where InstanceName has ":"

     

     

    .......and specifying specific drive letters is that the Azure BEK encryption drives don't seem to always end up with the same drive letter, so my WHERE statement has to be a bit more complex to pick specific drives from certain machines.

     

    Back on topic, the make-series statement that you suggested yesterday has worked perfectly to get the y axis to go from 0 - 100, it also allowed me to give the Y axis a custom name label which I hadn't yet worked out how to do.

     

    I also used this extend and strcat() statement to create a new series for the X axis with a better name and data that reads easier in the legend:

     

     

    | extend DiskName = strcat(Computer," (", InstanceName,")")

     

     

    You might have noticed I then used the new series in my version of your make-series to spilt the X series up the way I wanted.

     

    After all that, I've ended up with something very similar to this:

     

     

    Perf
| where TimeGenerated > ago(60d)
| where ObjectName == "LogicalDisk" | where CounterName == "% Free Space"
| where InstanceName == "C:" or InstanceName == "F:" or InstanceName == "E:"
| extend DiskName = strcat(Computer," (", InstanceName,")")
| make-series DiskFreeSpace = max(CounterValue)  default=0 on TimeGenerated  in range(ago(60d), now(), 12h) by DiskName
| render timechart title ="Virtual Machine Disk Usage"

     

     

     

    Which results in this:

     

     

    The data is quite spiky as the VMs are all relatively new, so the series will smooth out over a couple of months, and I still have some work to do to try and get it to display in local time (+12 GMT NZST), move the legend to the bottom (more like the built in Azure charts) and remove the dots off the series lines....... but fundamentally, this gives me what I need.

    Thank you very much for you help! I'm learning a lot as I go!

CliveWatson's avatar
CliveWatson
Former Employee
Oct 01, 2019

chrisbutler 

 

Its a busy chart but...this maybe?

 

Perf
| where TimeGenerated > ago(60d)
| where ObjectName == "LogicalDisk" | where CounterName == "% Free Space"
| where InstanceName has ":"  // just drive letters
| make-series pctDiskFreeSpace = max(CounterValue)  default=0 on TimeGenerated  in range(ago(60d), now(), 12h) by CounterPath
| render timechart title ="Virtual Machine Disk Usage"

 

chrisbutler's avatar
chrisbutler
Copper Contributor
Oct 01, 2019

CliveWatson 

 

Hey Clive,

 

Yes it is a busy chart, I have extra WHERE statements similar to yours in the Query I'm actually using that filter our a bunch of the disks that I'm not particularly interested in (Azure VM BEK and Temp storage drives especially) however I've left those out of my post as it identifies some of the machine names (and therefore could be extrapolated to the DNS name with enough trial and error).

The issue with just using:

 

 

| where InstanceName has ":"

 

 

.......and specifying specific drive letters is that the Azure BEK encryption drives don't seem to always end up with the same drive letter, so my WHERE statement has to be a bit more complex to pick specific drives from certain machines.

 

Back on topic, the make-series statement that you suggested yesterday has worked perfectly to get the y axis to go from 0 - 100, it also allowed me to give the Y axis a custom name label which I hadn't yet worked out how to do.

 

I also used this extend and strcat() statement to create a new series for the X axis with a better name and data that reads easier in the legend:

 

 

| extend DiskName = strcat(Computer," (", InstanceName,")")

 

 

You might have noticed I then used the new series in my version of your make-series to spilt the X series up the way I wanted.

 

After all that, I've ended up with something very similar to this:

 

 

Perf
| where TimeGenerated > ago(60d)
| where ObjectName == "LogicalDisk" | where CounterName == "% Free Space"
| where InstanceName == "C:" or InstanceName == "F:" or InstanceName == "E:"
| extend DiskName = strcat(Computer," (", InstanceName,")")
| make-series DiskFreeSpace = max(CounterValue)  default=0 on TimeGenerated  in range(ago(60d), now(), 12h) by DiskName
| render timechart title ="Virtual Machine Disk Usage"

 

 

 

Which results in this:

 

 

The data is quite spiky as the VMs are all relatively new, so the series will smooth out over a couple of months, and I still have some work to do to try and get it to display in local time (+12 GMT NZST), move the legend to the bottom (more like the built in Azure charts) and remove the dots off the series lines....... but fundamentally, this gives me what I need.

Thank you very much for you help! I'm learning a lot as I go!

Resources