'summarize' operator: Failed to resolve scalar expression named 'TimeGenerated'

[Dapeng Li]

I got the error as title, when execute below query, anyone know about this?

let containerNames = Perf
| where InstanceName like 'shenzhou-tts-829bbd20-3e9e-43a0-a7d7-35252d5ef498'
| where ObjectName == 'K8SContainer'
| where CounterName == "memoryRssBytes"
| distinct InstanceName;
containerNames
| join (
Perf
) on InstanceName
| where CounterName == "memoryRssBytes"
| extend usage = tolong(CounterValue)
| summarize max(usage) by InstanceName, Computer
| extend maxUsageMB = max_usage * 1.0/(1024*1024)
| summarize sum(maxUsageMB) by Computer, bin(TimeGenerated, 2h)

[#2 · Accepted solution]

Hi Dapeng Li,

Put shortly - once you apply the first `summarize` by instance name and computer, you lose the TimeGenerated column. I suggest you add the "bin" you use on the second `summarize` to the first one.

Additionally, when you use "join" you might over-complicate the query, and make it less efficient.

I suggest the following query (changed the first string to match our demo data)

let containerNames = Perf 
| where InstanceName like 'e4272367-5645-4c4e-9c67-3b74b59a6982'
| where ObjectName == 'K8SContainer'
| where CounterName == "memoryRssBytes"
| distinct InstanceName;
Perf
| where InstanceName in (containerNames)
| where CounterName == "memoryRssBytes"
| extend usage = tolong(CounterValue)
| extend usageMB = usage * 1.0/(1024*1024)
| summarize maxUsageMB=max(usageMB) by InstanceName, Computer, bin(TimeGenerated, 2h)
| summarize sum(maxUsageMB) by Computer, bin(TimeGenerated, 2h)

HTH,

Noa

[#3]

cool, thanks!