Forum Discussion

Dante Nahuel Ciai's avatar
Dante Nahuel Ciai
Brass Contributor
Jan 15, 2018
Solved

Search multiple perf counters

Hi all, I'm trying to learn the language and I want to search multiple perf counters on all connected computers, but I don't understand how. for example:   Perf | where (CounterName == "% Com...
azure monitor
Query Language
  • Noa Kuperberg's avatar
    Noa Kuperberg
    Jan 15, 2018

    Hey Dante,

    Try this query, it shows a number of perf counters, and the average calculated per computer and counter name. The results show the counter name in a separate column.

    Is this what you were looking for?

     

Henrik Olofsson's avatar
Henrik Olofsson
Copper Contributor
Jan 23, 2018

Hi Noa,

 

Is it in some way possible to use a matcher like contains or has in place of in?

...

| where CounterName contains/has ("% Committed", "% Used Mem", "% Proc")
 
Regards,
Henrik
Noa Kuperberg's avatar
Noa Kuperberg
Icon for Microsoft rankMicrosoft
Jan 23, 2018

Hi Henrik,

To check if a string contain any of a given list of values, you'd need to a evaluation each value separately, like this:

Perf 
| where CounterName contains "% Committed" 
or CounterName contains "% Used Mem" 
or CounterName contains "% Proc"
| summarize AggregatedValue = avg(CounterValue) by Computer, CounterName

The only string operator that accepts a list of values is "in". See the full list of string operators here.

 

Regards,

Noa

  • RCDevops777's avatar
    RCDevops777
    Copper Contributor
    Feb 21, 2019

    There is no Performance counter called % Used Memory in windows..I am also trying to find out how to get the Percentage of Memory used within  12 hours time...slice window of 1 hour  .Please let me know if anyone has the query for this

     

    Thanks

    R

    Noa Kuperberg wrote:

    Hi Henrik,

    To check if a string contain any of a given list of values, you'd need to a evaluation each value separately, like this:

    Perf 
| where CounterName contains "% Committed" 
    or CounterName contains "% Used Mem" 
    or CounterName contains "% Proc"
| summarize AggregatedValue = avg(CounterValue) by Computer, CounterName

    The only string operator that accepts a list of values is "in". See the full list of string operators https://docs.loganalytics.io/docs/Language-Reference/Scalar-operators/String-operators.

     

    Regards,

    Noa

    Noa Kuperberg wrote:

    Hi Henrik,

    To check if a string contain any of a given list of values, you'd need to a evaluation each value separately, like this:

    Perf 
| where CounterName contains "% Committed" 
    or CounterName contains "% Used Mem" 
    or CounterName contains "% Proc"
| summarize AggregatedValue = avg(CounterValue) by Computer, CounterName

    The only string operator that accepts a list of values is "in". See the full list of string operators https://docs.loganalytics.io/docs/Language-Reference/Scalar-operators/String-operators.

     

    Regards,

    Noa

     

Resources