SOLVED
Home

Search multiple perf counters

%3CLINGO-SUB%20id%3D%22lingo-sub-145151%22%20slang%3D%22en-US%22%3ESearch%20multiple%20perf%20counters%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-145151%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20all%2C%3C%2FP%3E%0A%3CP%3EI'm%20trying%20to%20learn%20the%20language%20and%20I%20want%20to%20search%20multiple%20perf%20counters%20on%20all%20connected%20computers%2C%20but%20I%20don't%20understand%20how.%3C%2FP%3E%0A%3CP%3Efor%20example%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EPerf%20%7C%20where%20(CounterName%20%3D%3D%20%22%25%20Committed%20Bytes%20In%20Use%22%20or%20CounterName%20%3D%3D%20%22%25%20Used%20Memory%22)%20%7C%20where%20CounterName%20%3D%3D%20%22%25%20Committed%20Bytes%20In%20Use%22%26nbsp%3B%20%7C%20summarize%20AggregatedValue%20%3D%20avg(CounterValue)%26nbsp%3B%20by%20Computer%20%7C%20sort%20by%20Computer%20desc%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EHow%20do%20I%20add%20CPU%20%25%20Processor%20Time%20to%20the%20query%20as%20a%20new%20column%3F%3CBR%20%2F%3E%3CBR%20%2F%3EThanks%20in%20advance.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-145151%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EQuery%20Language%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-354359%22%20slang%3D%22en-US%22%3ERe%3A%20Search%20multiple%20perf%20counters%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-354359%22%20slang%3D%22en-US%22%3E%3CP%3EThere%20is%20no%20Performance%20counter%20called%20%25%20Used%20Memory%20in%20windows..I%20am%20also%20trying%20to%20find%20out%20how%20to%20get%20the%20Percentage%20of%20Memory%20used%20within%26nbsp%3B%2012%20hours%20time...slice%20window%20of%201%20hour%26nbsp%3B%20.Please%20let%20me%20know%20if%20anyone%20has%20the%20query%20for%20this%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%3C%2FP%3E%3CP%3ER%3C%2FP%3E%3CBLOCKQUOTE%3E%3CHR%20%2F%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F54923%22%20target%3D%22_blank%22%3E%40Noa%20Kuperberg%3C%2FA%3E%26nbsp%3Bwrote%3A%3CBR%20%2F%3E%3CP%3EHi%20Henrik%2C%3C%2FP%3E%3CP%3ETo%20check%20if%20a%20string%20contain%20any%20of%20a%20given%20list%20of%20values%2C%20you'd%20need%20to%20a%20evaluation%20each%20value%20separately%2C%20like%20this%3A%3C%2FP%3E%3CPRE%3EPerf%20%0A%7C%20where%20CounterName%20contains%20%22%25%20Committed%22%20%3CBR%20%2F%3Eor%20CounterName%20contains%20%22%25%20Used%20Mem%22%20%3CBR%20%2F%3Eor%20CounterName%20contains%20%22%25%20Proc%22%0A%7C%20summarize%20AggregatedValue%20%3D%20avg(CounterValue)%20by%20Computer%2C%20CounterName%20%3C%2FPRE%3E%3CP%3EThe%20only%20string%20operator%20that%20accepts%20a%20list%20of%20values%20is%20%22in%22.%20See%26nbsp%3Bthe%20full%20list%20of%20string%20operators%20%3CA%20href%3D%22https%3A%2F%2Fdocs.loganalytics.io%2Fdocs%2FLanguage-Reference%2FScalar-operators%2FString-operators%22%20target%3D%22_blank%22%20rel%3D%22noopener%20nofollow%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehere%3C%2FA%3E.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ERegards%2C%3C%2FP%3E%3CP%3ENoa%3C%2FP%3E%3CBLOCKQUOTE%3E%3CHR%20%2F%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F54923%22%20target%3D%22_blank%22%3E%40Noa%20Kuperberg%3C%2FA%3E%26nbsp%3Bwrote%3A%3CBR%20%2F%3E%3CP%3EHi%20Henrik%2C%3C%2FP%3E%3CP%3ETo%20check%20if%20a%20string%20contain%20any%20of%20a%20given%20list%20of%20values%2C%20you'd%20need%20to%20a%20evaluation%20each%20value%20separately%2C%20like%20this%3A%3C%2FP%3E%3CPRE%3EPerf%20%0A%7C%20where%20CounterName%20contains%20%22%25%20Committed%22%20%3CBR%20%2F%3Eor%20CounterName%20contains%20%22%25%20Used%20Mem%22%20%3CBR%20%2F%3Eor%20CounterName%20contains%20%22%25%20Proc%22%0A%7C%20summarize%20AggregatedValue%20%3D%20avg(CounterValue)%20by%20Computer%2C%20CounterName%20%3C%2FPRE%3E%3CP%3EThe%20only%20string%20operator%20that%20accepts%20a%20list%20of%20values%20is%20%22in%22.%20See%26nbsp%3Bthe%20full%20list%20of%20string%20operators%20%3CA%20href%3D%22https%3A%2F%2Fdocs.loganalytics.io%2Fdocs%2FLanguage-Reference%2FScalar-operators%2FString-operators%22%20target%3D%22_blank%22%20rel%3D%22noopener%20nofollow%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehere%3C%2FA%3E.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ERegards%2C%3C%2FP%3E%3CP%3ENoa%3C%2FP%3E%3CHR%20%2F%3E%3C%2FBLOCKQUOTE%3E%3CHR%20%2F%3E%3C%2FBLOCKQUOTE%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-147892%22%20slang%3D%22en-US%22%3ERe%3A%20Search%20multiple%20perf%20counters%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-147892%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20Henrik%2C%3C%2FP%3E%0A%3CP%3ETo%20check%20if%20a%20string%20contain%20any%20of%20a%20given%20list%20of%20values%2C%20you'd%20need%20to%20a%20evaluation%20each%20value%20separately%2C%20like%20this%3A%3C%2FP%3E%0A%3CPRE%3EPerf%20%0A%7C%20where%20CounterName%20contains%20%22%25%20Committed%22%20%3CBR%20%2F%3Eor%20CounterName%20contains%20%22%25%20Used%20Mem%22%20%3CBR%20%2F%3Eor%20CounterName%20contains%20%22%25%20Proc%22%0A%7C%20summarize%20AggregatedValue%20%3D%20avg(CounterValue)%20by%20Computer%2C%20CounterName%20%3C%2FPRE%3E%0A%3CP%3EThe%20only%20string%20operator%20that%20accepts%20a%20list%20of%20values%20is%20%22in%22.%20See%26nbsp%3Bthe%20full%20list%20of%20string%20operators%20%3CA%20href%3D%22https%3A%2F%2Fdocs.loganalytics.io%2Fdocs%2FLanguage-Reference%2FScalar-operators%2FString-operators%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehere%3C%2FA%3E.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ERegards%2C%3C%2FP%3E%0A%3CP%3ENoa%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-147803%22%20slang%3D%22en-US%22%3ERe%3A%20Search%20multiple%20perf%20counters%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-147803%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20Noa%2C%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EIs%20it%20in%20some%20way%20possible%20to%20use%20a%20matcher%20like%26nbsp%3B%3CEM%3Econtains%3C%2FEM%3E%20or%20%3CEM%3Ehas%20%3C%2FEM%3Ein%20place%20of%20%3CEM%3Ein%3C%2FEM%3E%3F%3C%2FP%3E%0A%3CP%3E...%3C%2FP%3E%0A%3CDIV%3E%0A%3CDIV%3E%3CSPAN%3E%7C%20%3C%2FSPAN%3E%3CSPAN%3Ewhere%3C%2FSPAN%3E%3CSPAN%3E%20CounterName%26nbsp%3Bcontains%2Fhas%20(%3C%2FSPAN%3E%3CSPAN%3E%22%25%20Committed%22%3C%2FSPAN%3E%3CSPAN%3E%2C%20%3C%2FSPAN%3E%3CSPAN%3E%22%25%20Used%20Mem%22%3C%2FSPAN%3E%3CSPAN%3E%2C%20%3C%2FSPAN%3E%3CSPAN%3E%22%25%20Proc%22%3C%2FSPAN%3E%3CSPAN%3E)%3C%2FSPAN%3E%3C%2FDIV%3E%0A%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%0A%3CDIV%3E%3CSPAN%3ERegards%2C%3C%2FSPAN%3E%3C%2FDIV%3E%0A%3CDIV%3E%3CSPAN%3EHenrik%3C%2FSPAN%3E%3C%2FDIV%3E%0A%3C%2FDIV%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-146070%22%20slang%3D%22en-US%22%3ERe%3A%20Search%20multiple%20perf%20counters%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-146070%22%20slang%3D%22en-US%22%3E%3CP%3Eproject-away%20actually%20excludes%20field%20from%20the%20results.%20After%20join%2C%20fields%20that%20have%20the%20same%20name%20in%20both%20table%20(such%20as%20the%20field%20you%20join%20on)%20are%20shown%20as%20%22Fieldname%22%20and%20%22Fieldname1%22.%20If%20you%20want%20remove%20one%20of%20them%20from%20the%20result%20set%2C%20project-away%20is%20the%20easiest%20way.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-145473%22%20slang%3D%22en-US%22%3ERe%3A%20Search%20multiple%20perf%20counters%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-145473%22%20slang%3D%22en-US%22%3E%3CP%3EThank%20you%20for%20all%20your%20help.%3C%2FP%3E%0A%3CP%3EWhat%20is%20the%20project-away%20cmlet%3F%3C%2FP%3E%0A%3CP%3EThank%20you!%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-145434%22%20slang%3D%22en-US%22%3ERe%3A%20Search%20multiple%20perf%20counters%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-145434%22%20slang%3D%22en-US%22%3E%3CP%3EYes%2C%20you%20can%20do%20it%20%3CA%20href%3D%22https%3A%2F%2Fportal.loganalytics.io%2FDemo%3Fq%3DH4sIAAAAAAAAA62SsU7DMBCG90h5h1%252BRkFopCw%252FgAZg6gDIAq2Waa3Eb29XZLgri4bEJjSrSUgZuss7f%252FffJckO8Qll84O2VmHDnog3ED8oQhEB1lTrG6BCoxW0fyGNh8eSpyiM%252BGqNYvxNu9sRqTXKE5RcsF1YmWKj9evad%252FKy6SHO89Dl4F1MnJ22ctthq24pV7DqX25glLaAZ%252FJDqvGPa0eKejOO%252BOrBTuUzJgbpkNESctBoucx2p%252Fa7XsFuS947xqA1VxyNTyxGWGf6L6BzOTtx37Da0DGNfHA7X9akHqc%252FsL4sf6f%252BWXF%252F4NGXxCX53JoWbAgAA%26amp%3Btimespan%3DP1D%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ethis%3C%2FA%3E%20way.%3C%2FP%3E%0A%3CP%3ENote%20that%20I%20used%20join%20kind%20%22fullouter%22%20to%20includes%20all%20records%2C%20while%20the%20default%20join%20behavior%20is%20to%20show%20only%20records%20that%20match%20and%20exists%20on%20both%26nbsp%3Bleft%20and%20right%20tables.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-145249%22%20slang%3D%22en-US%22%3ERe%3A%20Search%20multiple%20perf%20counters%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-145249%22%20slang%3D%22en-US%22%3EI%20did%20a%20bit%20of%20research%20and%20I%20found%20I%20can%20do%20that%20with%20a%20Join%2C%20am%20I%20correct%3F%20although%20Im%20not%20sure%20how%20it%20works%20(language%20side)%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-145247%22%20slang%3D%22en-US%22%3ERe%3A%20Search%20multiple%20perf%20counters%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-145247%22%20slang%3D%22en-US%22%3EThank%20you%20a%20lot%20for%20that!%20It's%20indeed%20very%20similar%20to%20what%20I'm%20looking%20for.%3CBR%20%2F%3EHowever%2C%20I%20want%20to%20separate%20each%20counter%20in%20a%20different%20column.%3CBR%20%2F%3EIs%20that%20possible%3F%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-145195%22%20slang%3D%22en-US%22%3ERe%3A%20Search%20multiple%20perf%20counters%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-145195%22%20slang%3D%22en-US%22%3E%3CP%3EHey%20Dante%2C%3C%2FP%3E%0A%3CP%3ETry%20%3CA%20href%3D%22https%3A%2F%2Fportal.loganalytics.io%2FDemo%3Fq%3DH4sIAAAAAAAAA1WOsQrCQBBE%252B4D%252FMASECPkFC7WyUFKo%252FZmM54Gbk707JeLHe0YL7Ya3y5tpqCdMiifuZyqx8qmP1K0RwvWoymlGIi5GdlgOkQHrHvvAska%252B5dBhQ%252FE6fECjvmUIXrFzwnI2qkMSMeoexMJapTVZdjCXRMxhbrb6lo5ohuPwrrymTOq%252FPaPKa%252Fz9QMfQongBZG%252F%252FPcYAAAA%253D%26amp%3Btimespan%3DP1D%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ethis%3C%2FA%3E%26nbsp%3Bquery%2C%20it%20shows%20a%20number%20of%20perf%20counters%2C%20and%20the%20average%20calculated%20per%20computer%20and%20counter%20name.%20The%20results%20show%20the%20counter%20name%20in%20a%20separate%20column.%3C%2FP%3E%0A%3CP%3EIs%20this%20what%20you%20were%20looking%20for%3F%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E
Dante Nahuel Ciai
Contributor

Hi all,

I'm trying to learn the language and I want to search multiple perf counters on all connected computers, but I don't understand how.

for example:

 

Perf | where (CounterName == "% Committed Bytes In Use" or CounterName == "% Used Memory") | where CounterName == "% Committed Bytes In Use"  | summarize AggregatedValue = avg(CounterValue)  by Computer | sort by Computer desc 

 

How do I add CPU % Processor Time to the query as a new column?

Thanks in advance.

9 Replies
Solution

Hey Dante,

Try this query, it shows a number of perf counters, and the average calculated per computer and counter name. The results show the counter name in a separate column.

Is this what you were looking for?

 

Thank you a lot for that! It's indeed very similar to what I'm looking for.
However, I want to separate each counter in a different column.
Is that possible?
I did a bit of research and I found I can do that with a Join, am I correct? although Im not sure how it works (language side)

Yes, you can do it this way.

Note that I used join kind "fullouter" to includes all records, while the default join behavior is to show only records that match and exists on both left and right tables.

Thank you for all your help.

What is the project-away cmlet?

Thank you!

project-away actually excludes field from the results. After join, fields that have the same name in both table (such as the field you join on) are shown as "Fieldname" and "Fieldname1". If you want remove one of them from the result set, project-away is the easiest way.

Hi Noa,

 

Is it in some way possible to use a matcher like contains or has in place of in?

...

| where CounterName contains/has ("% Committed", "% Used Mem", "% Proc")
 
Regards,
Henrik
Highlighted

Hi Henrik,

To check if a string contain any of a given list of values, you'd need to a evaluation each value separately, like this:

Perf 
| where CounterName contains "% Committed" 
or CounterName contains "% Used Mem"
or CounterName contains "% Proc" | summarize AggregatedValue = avg(CounterValue) by Computer, CounterName

The only string operator that accepts a list of values is "in". See the full list of string operators here.

 

Regards,

Noa

There is no Performance counter called % Used Memory in windows..I am also trying to find out how to get the Percentage of Memory used within  12 hours time...slice window of 1 hour  .Please let me know if anyone has the query for this

 

Thanks

R


@Noa Kuperberg wrote:

Hi Henrik,

To check if a string contain any of a given list of values, you'd need to a evaluation each value separately, like this:

Perf 
| where CounterName contains "% Committed" 
or CounterName contains "% Used Mem"
or CounterName contains "% Proc" | summarize AggregatedValue = avg(CounterValue) by Computer, CounterName

The only string operator that accepts a list of values is "in". See the full list of string operators here.

 

Regards,

Noa


@Noa Kuperberg wrote:

Hi Henrik,

To check if a string contain any of a given list of values, you'd need to a evaluation each value separately, like this:

Perf 
| where CounterName contains "% Committed" 
or CounterName contains "% Used Mem"
or CounterName contains "% Proc" | summarize AggregatedValue = avg(CounterValue) by Computer, CounterName

The only string operator that accepts a list of values is "in". See the full list of string operators here.

 

Regards,

Noa



 

Related Conversations
Tabs and Dark Mode
cjc2112 in Discussions on
22 Replies
Stable version of Edge insider browser
HotCakeX in Discussions on
35 Replies
flashing a white screen while open new tab
cntvertex in Discussions on
13 Replies
How to Prevent Teams from Auto-Launch
chenrylee in Microsoft Teams on
28 Replies