Search multiple perf counters

[Dante Nahuel Ciai]

Hi all,

I'm trying to learn the language and I want to search multiple perf counters on all connected computers, but I don't understand how.

for example:

Perf | where (CounterName == "% Committed Bytes In Use" or CounterName == "% Used Memory") | where CounterName == "% Committed Bytes In Use"  | summarize AggregatedValue = avg(CounterValue)  by Computer | sort by Computer desc 

How do I add CPU % Processor Time to the query as a new column?

Thanks in advance.

[#2 · Accepted solution]

Hey Dante,

Try this query, it shows a number of perf counters, and the average calculated per computer and counter name. The results show the counter name in a separate column.

Is this what you were looking for?

[#3]

Thank you a lot for that! It's indeed very similar to what I'm looking for.
However, I want to separate each counter in a different column.
Is that possible?

[#4]

I did a bit of research and I found I can do that with a Join, am I correct? although Im not sure how it works (language side)

[#5]

Yes, you can do it this way.

Note that I used join kind "fullouter" to includes all records, while the default join behavior is to show only records that match and exists on both left and right tables.

[#6]

Thank you for all your help.

What is the project-away cmlet?

Thank you!

[#7]

project-away actually excludes field from the results. After join, fields that have the same name in both table (such as the field you join on) are shown as "Fieldname" and "Fieldname1". If you want remove one of them from the result set, project-away is the easiest way.

[#8]

Hi Noa,

Is it in some way possible to use a matcher like contains or has in place of in?

...

| where CounterName contains/has ("% Committed", "% Used Mem", "% Proc")

Regards,

Henrik

[#9]

Hi Henrik,

To check if a string contain any of a given list of values, you'd need to a evaluation each value separately, like this:

Perf 
| where CounterName contains "% Committed" 
or CounterName contains "% Used Mem" 
or CounterName contains "% Proc"
| summarize AggregatedValue = avg(CounterValue) by Computer, CounterName 

The only string operator that accepts a list of values is "in". See the full list of string operators here.

Regards,

Noa

[#10]

There is no Performance counter called % Used Memory in windows..I am also trying to find out how to get the Percentage of Memory used within  12 hours time...slice window of 1 hour  .Please let me know if anyone has the query for this

Thanks

R

---

@Noa Kuperberg wrote:

Hi Henrik,

To check if a string contain any of a given list of values, you'd need to a evaluation each value separately, like this:

Perf 
| where CounterName contains "% Committed" 
or CounterName contains "% Used Mem" 
or CounterName contains "% Proc"
| summarize AggregatedValue = avg(CounterValue) by Computer, CounterName 

The only string operator that accepts a list of values is "in". See the full list of string operators here.

Regards,

Noa

---

@Noa Kuperberg wrote:

Hi Henrik,

To check if a string contain any of a given list of values, you'd need to a evaluation each value separately, like this:

Perf 
| where CounterName contains "% Committed" 
or CounterName contains "% Used Mem" 
or CounterName contains "% Proc"
| summarize AggregatedValue = avg(CounterValue) by Computer, CounterName 

The only string operator that accepts a list of values is "in". See the full list of string operators here.

Regards,

Noa

---

---

[#11]

I have diff types of server like APP, DB, Archival and DR, all are under the same log analytics workspace.
For which I want to set diff memory counters, like DB 80% APP 70% DR 30% so we get alerts.
Currently, we have set for all servers at 80 % as below how can we do the above?

Perf
| where CounterName == "% Committed Bytes In Use"
| where TimeGenerated > ago(30m) | summarize avg = avg(CounterValue) by Computer | where avg > 80

[#12]

@RagSaw 

You need a way to identify the servers by their type,  here I'm using the computer name in a few ways (just to show some of the options you can use), to find the computer type and then assign a value and a default value.  You may have another identifier other than computer name, but you can use a "case" on that data, like this example:

Perf
| where TimeGenerated > ago(1h) 
| summarize by Computer, CounterName, CounterValue
| extend groupThreshold_ = case
                            (
                                Computer startswith "THAM", 10,
                                Computer endswith   "01",70,
                                Computer has        "aks",60,
                                Computer contains   "RDS",65,                       
                                //else use default value
                            50
                            )
| where CounterName == "% Committed Bytes In Use"
| summarize avg = avg(CounterValue) by Computer, groupThreshold_
| where avg > groupThreshold_     

[#13]

Hi Clive,

I will try this, Thank you a lot for that :j