Forum Discussion
Arslan11
Apr 30, 2020Brass Contributor
Report on selected servers for a week on the memory usage
I would like a help with a Kusto query which I have almost completed but I am struggling in the last part.
Kusto query
Perf
| where ObjectName == "Memory" and CounterName == "% Committed Bytes In Use" and Computer == "VM-WVD-REL86-5.networkhg.org.uk"
| extend Used_Percent_Memory = 100- CounterValue
| summarize Used_Percent_Memory = max(CounterValue) by Computer, ObjectName
| where Used_Percent_Memory < 90 and Used_Percent_Memory > 70
This query shows me percent memory being used over 70% for specific server
But I would like to add a extra line in this query, where it will show me the memory percent for 5 days for this relevant server
I found this but I am not sure where to exactly added within this query.
let start_time=startofday(datetime("2018-03-01"));
let end_time=now();
- CliveWatson
Microsoft
Perf | where TimeGenerated > startofday(ago(5d)) // from midnight, just use ago(5d) for 5days before now | where ObjectName == "Memory" and CounterName == "% Committed Bytes In Use" //and Computer == "VM-WVD-REL86-5.networkhg.org.uk" | extend Used_Percent_Memory = 100- CounterValue | summarize Used_Percent_Memory = max(CounterValue) by Computer, ObjectName | where Used_Percent_Memory < 90 and Used_Percent_Memory > 70
Computer ObjectName Used_Percent_Memory Computer1 Memory 77.8518753051758 Computer2 Memory 83.6081695556641 You could also use startofweek()
Perf | where TimeGenerated > startofweek(now()) | where ObjectName == "Memory" and CounterName == "% Committed Bytes In Use" //and Computer == "VM-WVD-REL86-5.networkhg.org.uk" | extend Used_Percent_Memory = 100- CounterValue | summarize Used_Percent_Memory = max(CounterValue), min(TimeGenerated) by Computer, ObjectName | where Used_Percent_Memory < 90 and Used_Percent_Memory > 70
Computer ObjectName Used_Percent_Memory min_TimeGenerated Computer1 Memory 77.8518753051758 2020-04-27T09:00:52.997Z Computer2 Memory 83.6081695556641 2020-04-26T00:00:03.257Z You can also compare weeks, example
Perf | where TimeGenerated > startofday(ago(14d)) | where Computer startswith "retail" | where ObjectName == "Memory" and CounterName == "% Committed Bytes In Use" | extend Used_Percent_Memory = 100- CounterValue | summarize This_week_Used_Percent_Memory = max(CounterValue) by bin(TimeGenerated, 1d), Computer, ObjectName | order by TimeGenerated asc | extend PrevWeek=prev(This_week_Used_Percent_Memory, 7) | where TimeGenerated > ago(7d) | project TimeGenerated, This_week_Used_Percent_Memory , PrevWeek | render timechart
- Arslan11Brass Contributor
CliveWatson Thanks , I tired your query but it didn't answer my question, I have pasted the query.
| where TimeGenerated > startofday(ago(1d))| where ObjectName == "Memory" and CounterName == "% Committed Bytes In Use" and Computer == "VM-WVD-REL86-5.networkhg.org.uk"| extend Used_Percent_Memory = 100- CounterValue| summarize Used_Percent_Memory = max(CounterValue), min(TimeGenerated) by Computer, ObjectName| where Used_Percent_Memory < 90 and Used_Percent_Memory > 70what I really want , I want my ""VM-WVD-REL86-5.networkhg.org.uk" server to show me the results of memory usage for 5 days.I have attached the picture to this post, table is showing value for 1 day but I want it to show value for the 5 days. for instance , I want the query to show the memory usage for Monday, Tuesday, Wednesday, Thursday and Friday for the server ""VM-WVD-REL86-5.networkhg.org.uk". I hope , you will work this out
- CliveWatson
Microsoft
I see now, so change to this:
Perf | where TimeGenerated > startofday(ago(5d)) | where ObjectName == "Memory" and CounterName == "% Committed Bytes In Use" | where Computer startswith "retail" | extend Used_Percent_Memory = 100- CounterValue | summarize Used_Percent_Memory = max(CounterValue)by bin(TimeGenerated,1d) , Computer, ObjectName | where Used_Percent_Memory < 90 and Used_Percent_Memory > 70
We take 5 days of data, then use a BIN in the summarise line to group the results per day
| where TimeGenerated > startofday(ago(5d))and| summarize Used_Percent_Memory = max(CounterValue)by bin(TimeGenerated,1d) , Computer, ObjectNameTimeGenerated Computer ObjectName Used_Percent_Memory 2020-05-01T00:00:00Z retail Memory 83.4487609863281 2020-04-28T00:00:00Z retail Memory 83.6081695556641 2020-04-30T00:00:00Z retail Memory 83.2831649780273 2020-04-26T00:00:00Z retail Memory 83.5125961303711 2020-04-29T00:00:00Z retail Memory 82.2031326293945 2020-04-27T00:00:00Z retail Memory 81.8324279785156 e.g.