Forum Discussion

roopesh_shetty's avatar
roopesh_shetty
Copper Contributor
Apr 24, 2020

TimeGenerated challenge

Hi Guys,

 

I have this below query which is working fine as expected;

 

Perf

| where ObjectName == "Processor" and CounterName == "% Processor Time"

| make-series AVG_USAGE=avg(CounterValue)  default=0 on TimeGenerated from datetime(2020-04-18) to datetime(2020-04-23) step 1h by Computer

| project Computer,  AVG_USAGE

 

But I want to run this query on every hour so that the TimeGenerated should be the last 60 minutes so I want to replace this static value (TimeGenerated from datetime(2020-04-18) to datetime(2020-04-23)) to last 60 minutes in every run.

I tried putting TimeGenerated > ago(60m) as below, but its not taking it

 

| make-series AVG_USAGE=avg(CounterValue)  default=0 on TimeGenerated > ago(60m)  step 1h by Computer

 

Any idea how to place the syntax as last 60 minutes there instead of that fixed Time range.

2 Replies

  • roopesh_shetty 

     

    How about?

    let eTime = now();
    let sTime = now(-60m);
    Perf
    //| project sTime, eTime
    | where ObjectName == "Processor" and CounterName == "% Processor Time"
    | make-series AVG_USAGE=avg(CounterValue)  default=0 on TimeGenerated from sTime to eTime step 1h by Computer
    | project Computer,  AVG_USAGE

       

Resources