SOLVED
Home

Custom OMS dashboard chart with 4 columns

%3CLINGO-SUB%20id%3D%22lingo-sub-181108%22%20slang%3D%22en-US%22%3ECustom%20OMS%20dashboard%20chart%20with%204%20columns%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-181108%22%20slang%3D%22en-US%22%3E%3CP%3EHi%2C%20cannot%20figure%20out%20how%20to%20create%20custom%20dashboard%20chart%20with%204%20columns.%20i%20already%20have%20query%20for%20this%20dashboard.%20Just%20simple%20view%2C%20maybe%20with%20threshold%20colors.%20Thanks.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fportal.loganalytics.io%2FDemo%3Fq%3DH4sIAAAAAAAAA8WSQUvEMBCF7%252FkVQ0FoYC96VOphFUWwuqB4lWn6tmZtkpKk6Io%252F3mzVWlcWT2KObx7zXj6mRaRah8elBzp4BRsLWsAvxSs9PcCDbrXBOSw8R9R0TNy4fL%252BW4%252Fy6WkHFKzagoqDs0jVacXuadmbEtqYT19sIPxr26Cxl0U3HClnaEnpj2OsXUP4tajb4BtvivZgs2Df3hp%252B3jR8Rd9z2kFStk2C6PikzurAhslXYxI%252BVQ%252FQtbD6dydTtYOg7VUk5G1nbQNlhdiTaCaxy%252FsecBkolGq7WEeF3UuX83%252FlsHVLat3LailxQel%252FghBTO7u7QebchtcPw8yw%252Bvy%252FeAO%252BuQlfMAgAA%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fportal.loganalytics.io%2FDemo%3Fq%3DH4sIAAAAAAAAA8WSQUvEMBCF7%252FkVQ0FoYC96VOphFUWwuqB4lWn6tmZtkpKk6Io%252F3mzVWlcWT2KObx7zXj6mRaRah8elBzp4BRsLWsAvxSs9PcCDbrXBOSw8R9R0TNy4fL%252BW4%252Fy6WkHFKzagoqDs0jVacXuadmbEtqYT19sIPxr26Cxl0U3HClnaEnpj2OsXUP4tajb4BtvivZgs2Df3hp%252B3jR8Rd9z2kFStk2C6PikzurAhslXYxI%252BVQ%252FQtbD6dydTtYOg7VUk5G1nbQNlhdiTaCaxy%252FsecBkolGq7WEeF3UuX83%252FlsHVLat3LailxQel%252FghBTO7u7QebchtcPw8yw%252Bvy%252FeAO%252BuQlfMAgAA%3C%2FA%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Elet%20diskfreepercent%3D%20Perf%3CBR%20%2F%3E%7C%20where%20TimeGenerated%20%26gt%3B%20ago(1d)%3CBR%20%2F%3E%7C%20where%20ObjectName%20%3D%3D%20%22LogicalDisk%22%20and%20CounterName%20%3D%3D%20%22%25%20Free%20Space%22%3CBR%20%2F%3E%7C%20summarize%20(TimeGenerated%2C%20FreeSpacePercent)%3Darg_max(TimeGenerated%2C%20CounterValue)%20by%20Computer%2C%20InstanceName%3CBR%20%2F%3E%7C%20where%20strlen(InstanceName)%20%3D%3D2%20and%20InstanceName%20contains%20%22%3A%22%3B%3CBR%20%2F%3Elet%20diskfreeMB%3D%20Perf%3CBR%20%2F%3E%7C%20where%20TimeGenerated%20%26gt%3B%20ago(1d)%3CBR%20%2F%3E%7C%20where%20ObjectName%20%3D%3D%20%22LogicalDisk%22%20and%20CounterName%20%3D%3D%20%22Free%20Megabytes%22%3CBR%20%2F%3E%7C%20summarize%20(TimeGenerated%2C%20FreeMB)%3Darg_max(TimeGenerated%2C%20CounterValue)%20by%20Computer%2C%20InstanceName%3CBR%20%2F%3E%7C%20where%20strlen(InstanceName)%20%3D%3D2%20and%20InstanceName%20contains%20%22%3A%22%3B%3CBR%20%2F%3Ediskfreepercent%3CBR%20%2F%3E%7C%20join%3CBR%20%2F%3E(%3CBR%20%2F%3EdiskfreeMB%3CBR%20%2F%3E)%3CBR%20%2F%3Eon%20Computer%2C%20InstanceName%3CBR%20%2F%3E%7C%20project%20Computer%2C%20InstanceName%2C%20FreeSpacePercent%2C%20FreeMB%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-181108%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EOMS%20Log%20Analytics%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-182129%22%20slang%3D%22en-US%22%3ERe%3A%20Custom%20OMS%20dashboard%20chart%20with%204%20columns%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-182129%22%20slang%3D%22en-US%22%3EThanks%20for%20your%20quick%20and%20precise%20responses.%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-182020%22%20slang%3D%22en-US%22%3ERe%3A%20Custom%20OMS%20dashboard%20chart%20with%204%20columns%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-182020%22%20slang%3D%22en-US%22%3E%3CP%3EYou%20can%20do%3C%2FP%3E%0A%3CPRE%3Etostring(round(FreeSpacePercent%2C2))%3C%2FPRE%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-182011%22%20slang%3D%22en-US%22%3ERe%3A%20Custom%20OMS%20dashboard%20chart%20with%204%20columns%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-182011%22%20slang%3D%22en-US%22%3EThis%20is%20something%20closer%20to%20what%20i%20would%20like%20to%20achieve.%20How%20to%20limit%20string%20output%20to%202-4%20digits%20%3F%3CBR%20%2F%3Etostring(FreeSpacePercent)%3CBR%20%2F%3E%3CBR%20%2F%3ENow%20it%20returns%20%25%20of%20free%20space%20like%20that%2072.025016784668%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-181531%22%20slang%3D%22en-US%22%3ERe%3A%20Custom%20OMS%20dashboard%20chart%20with%204%20columns%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-181531%22%20slang%3D%22en-US%22%3E%3CP%3ETo%20be%20precise%20the%20list%20view%20can%20show%20up%204%20columns%20just%20not%20two%20columns%20where%20there%20are%20numbers.%20You%20can%20potentially%20do%20something%20like%20this%3A%3C%2FP%3E%0A%3CPRE%3Elet%20diskfreepercent%3D%20Perf%20%7C%20where%20TimeGenerated%20%26gt%3B%20ago(1d)%20%7C%20where%20ObjectName%20%3D%3D%20%22LogicalDisk%22%20and%20CounterName%20%3D%3D%20%22%25%20Free%20Space%22%20%7C%20summarize%20(TimeGenerated%2C%20FreeSpacePercent)%3Darg_max(TimeGenerated%2C%20CounterValue)%20by%20Computer%2C%20InstanceName%20%7C%20where%20strlen(InstanceName)%20%3D%3D2%20and%20InstanceName%20contains%20%22%3A%22%3B%20let%20diskfreeMB%3D%20Perf%20%7C%20where%20TimeGenerated%20%26gt%3B%20ago(1d)%20%7C%20where%20ObjectName%20%3D%3D%20%22LogicalDisk%22%20and%20CounterName%20%3D%3D%20%22Free%20Megabytes%22%20%7C%20summarize%20(TimeGenerated%2C%20FreeMB)%3Darg_max(TimeGenerated%2C%20CounterValue)%20by%20Computer%2C%20InstanceName%20%7C%20where%20strlen(InstanceName)%20%3D%3D2%20and%20InstanceName%20contains%20%22%3A%22%3B%20diskfreepercent%20%7C%20join%20(%20diskfreeMB%20)%20on%20Computer%2C%20InstanceName%20%7C%20project%20Computer%2C%20InstanceName%2C%20%20tostring(FreeSpacePercent)%2C%20FreeMB%3C%2FPRE%3E%0A%3CP%3EAnd%20it%20will%20show%20the%204%20columns%20but%20as%20you%20see%20I%20am%20converting%20one%20of%20the%20numeric%20values%20to%20string.%20Also%20sorting%20can%20be%20done%20only%20on%20FreeMB%20column.%20My%20proposal%20is%20to%20create%20two%20lists%20views%20side%20by%20side.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-181255%22%20slang%3D%22en-US%22%3ERe%3A%20Custom%20OMS%20dashboard%20chart%20with%204%20columns%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-181255%22%20slang%3D%22en-US%22%3EThanks%20Stanislav%2C%20seems%20a%20bit%20odd%20that%20there%20isn't%20option%20to%20add%20table%20dashboard%20with%204%20columns.%20%3A)%3C%2Fimg%3E%3CBR%20%2F%3EProbably%20will%20use%20two%20separate%20dashboards%20then.%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-181212%22%20slang%3D%22en-US%22%3ERe%3A%20Custom%20OMS%20dashboard%20chart%20with%204%20columns%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-181212%22%20slang%3D%22en-US%22%3E%3CP%3EOk.%20I%20though%20you've%20meant%20Azure%20Dashboard%20chart%20because%20you've%20pasted%20query%20that%20is%20executed%20in%20the%20Advanced%20portal.%20You%20cannot%20create%20List%20View%20in%20Log%20Analytics%20view%20that%20shows%20two%20numeric%20columns.%20You%20can%20either%20create%20List%20view%20with%20Free%20Space%20%25%20or%20with%20FreeMB%20or%20two%20list%20views%20showing%20each%20one%20of%20them.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-181207%22%20slang%3D%22en-US%22%3ERe%3A%20Custom%20OMS%20dashboard%20chart%20with%204%20columns%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-181207%22%20slang%3D%22en-US%22%3E%3CP%3ETo%20clarify%2C%20i%20would%20like%20to%20crate%20dashboard%20with%204%20columns%20-%20Computer%2C%20Disk(in%20example%20its%20instance%20name)%2C%20Free%20Space%20%25%20and%20Free%20MB%2C%20charts%20are%20not%20so%20important%2C%20there%20should%20be%20columns.%20Check%20screenshot.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-181181%22%20slang%3D%22en-US%22%3ERe%3A%20Custom%20OMS%20dashboard%20chart%20with%204%20columns%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-181181%22%20slang%3D%22en-US%22%3E%3CP%3EHi%26nbsp%3B%3C%2FP%3E%0A%3CP%3EI%20would%20guess%20you%20want%20to%20create%20a%20chart%20but%20it%20is%20not%20possible%20to%20create%20a%20chart%20on%26nbsp%3Bfour%20columns.%20You%20can%20create%20a%20chart%20on%20two%20columns%20where%20one%20is%20one%20of%20them%20is%20for%20the%20x-Axes%20and%20the%20other%20for%20the%20y-Axes.%20Taking%20your%20example%20like%20this%3A%3C%2FP%3E%0A%3CPRE%3Elet%20diskfreepercent%3D%20Perf%0A%7C%20where%20TimeGenerated%20%26gt%3B%20ago(1d)%0A%7C%20where%20ObjectName%20%3D%3D%20%22LogicalDisk%22%20and%20CounterName%20%3D%3D%20%22%25%20Free%20Space%22%0A%7C%20summarize%20(TimeGenerated%2C%20FreeSpacePercent)%3Darg_max(TimeGenerated%2C%20CounterValue)%20by%20Computer%2C%20InstanceName%0A%7C%20where%20strlen(InstanceName)%20%3D%3D2%20and%20InstanceName%20contains%20%22%3A%22%3B%0Alet%20diskfreeMB%3D%20Perf%0A%7C%20where%20TimeGenerated%20%26gt%3B%20ago(1d)%0A%7C%20where%20ObjectName%20%3D%3D%20%22LogicalDisk%22%20and%20CounterName%20%3D%3D%20%22Free%20Megabytes%22%0A%7C%20summarize%20(TimeGenerated%2C%20FreeMB)%3Darg_max(TimeGenerated%2C%20CounterValue)%20by%20Computer%2C%20InstanceName%0A%7C%20where%20strlen(InstanceName)%20%3D%3D2%20and%20InstanceName%20contains%20%22%3A%22%3B%0Adiskfreepercent%0A%7C%20join%0A(%0A%20%20%20%20diskfreeMB%0A)%0Aon%20Computer%2C%20InstanceName%0A%7C%20project%20Computer%2C%20FreeSpacePercent%20%7C%20render%20barchart%20%0A%3C%2FPRE%3E%0A%3CP%3EOf%20course%20this%20removes%20the%20InstanceName%20and%20the%20FreeMB%20columns.%20Only%20a%20table%20can%20list%20all%204%20columns%20but%20that%20is%20not%20a%20chart.%3C%2FP%3E%3C%2FLINGO-BODY%3E
Deleted
Not applicable

Hi, cannot figure out how to create custom dashboard chart with 4 columns. i already have query for this dashboard. Just simple view, maybe with threshold colors. Thanks.

 

https://portal.loganalytics.io/Demo?q=H4sIAAAAAAAAA8WSQUvEMBCF7%2FkVQ0FoYC96VOphFUWwuqB4lWn6tmZtkpKk...

 

 

let diskfreepercent= Perf
| where TimeGenerated > ago(1d)
| where ObjectName == "LogicalDisk" and CounterName == "% Free Space"
| summarize (TimeGenerated, FreeSpacePercent)=arg_max(TimeGenerated, CounterValue) by Computer, InstanceName
| where strlen(InstanceName) ==2 and InstanceName contains ":";
let diskfreeMB= Perf
| where TimeGenerated > ago(1d)
| where ObjectName == "LogicalDisk" and CounterName == "Free Megabytes"
| summarize (TimeGenerated, FreeMB)=arg_max(TimeGenerated, CounterValue) by Computer, InstanceName
| where strlen(InstanceName) ==2 and InstanceName contains ":";
diskfreepercent
| join
(
diskfreeMB
)
on Computer, InstanceName
| project Computer, InstanceName, FreeSpacePercent, FreeMB

8 Replies

Hi 

I would guess you want to create a chart but it is not possible to create a chart on four columns. You can create a chart on two columns where one is one of them is for the x-Axes and the other for the y-Axes. Taking your example like this:

let diskfreepercent= Perf
| where TimeGenerated > ago(1d)
| where ObjectName == "LogicalDisk" and CounterName == "% Free Space"
| summarize (TimeGenerated, FreeSpacePercent)=arg_max(TimeGenerated, CounterValue) by Computer, InstanceName
| where strlen(InstanceName) ==2 and InstanceName contains ":";
let diskfreeMB= Perf
| where TimeGenerated > ago(1d)
| where ObjectName == "LogicalDisk" and CounterName == "Free Megabytes"
| summarize (TimeGenerated, FreeMB)=arg_max(TimeGenerated, CounterValue) by Computer, InstanceName
| where strlen(InstanceName) ==2 and InstanceName contains ":";
diskfreepercent
| join
(
    diskfreeMB
)
on Computer, InstanceName
| project Computer, FreeSpacePercent | render barchart 

Of course this removes the InstanceName and the FreeMB columns. Only a table can list all 4 columns but that is not a chart.

To clarify, i would like to crate dashboard with 4 columns - Computer, Disk(in example its instance name), Free Space % and Free MB, charts are not so important, there should be columns. Check screenshot.

Ok. I though you've meant Azure Dashboard chart because you've pasted query that is executed in the Advanced portal. You cannot create List View in Log Analytics view that shows two numeric columns. You can either create List view with Free Space % or with FreeMB or two list views showing each one of them.

Thanks Stanislav, seems a bit odd that there isn't option to add table dashboard with 4 columns. :)
Probably will use two separate dashboards then.
Solution

To be precise the list view can show up 4 columns just not two columns where there are numbers. You can potentially do something like this:

let diskfreepercent= Perf | where TimeGenerated > ago(1d) | where ObjectName == "LogicalDisk" and CounterName == "% Free Space" | summarize (TimeGenerated, FreeSpacePercent)=arg_max(TimeGenerated, CounterValue) by Computer, InstanceName | where strlen(InstanceName) ==2 and InstanceName contains ":"; let diskfreeMB= Perf | where TimeGenerated > ago(1d) | where ObjectName == "LogicalDisk" and CounterName == "Free Megabytes" | summarize (TimeGenerated, FreeMB)=arg_max(TimeGenerated, CounterValue) by Computer, InstanceName | where strlen(InstanceName) ==2 and InstanceName contains ":"; diskfreepercent | join ( diskfreeMB ) on Computer, InstanceName | project Computer, InstanceName,  tostring(FreeSpacePercent), FreeMB

And it will show the 4 columns but as you see I am converting one of the numeric values to string. Also sorting can be done only on FreeMB column. My proposal is to create two lists views side by side.

This is something closer to what i would like to achieve. How to limit string output to 2-4 digits ?
tostring(FreeSpacePercent)

Now it returns % of free space like that 72.025016784668

You can do

tostring(round(FreeSpacePercent,2))
Thanks for your quick and precise responses.
Related Conversations
Tabs and Dark Mode
cjc2112 in Discussions on
48 Replies
Extentions Synchronization
Deleted in Discussions on
3 Replies
Stable version of Edge insider browser
HotCakeX in Discussions on
35 Replies
How to Prevent Teams from Auto-Launch
chenrylee in Microsoft Teams on
30 Replies
flashing a white screen while open new tab
Deleted in Discussions on
14 Replies
Security Community Webinars
Valon_Kolica in Security, Privacy & Compliance on
13 Replies