Apr 24 2020
02:41 AM
- last edited on
Apr 08 2022
10:24 AM
by
TechCommunityAP
Apr 24 2020
02:41 AM
- last edited on
Apr 08 2022
10:24 AM
by
TechCommunityAP
Hi Guys,
I have this below query which is working fine as expected;
Perf
| where ObjectName == "Processor" and CounterName == "% Processor Time"
| make-series AVG_USAGE=avg(CounterValue) default=0 on TimeGenerated from datetime(2020-04-18) to datetime(2020-04-23) step 1h by Computer
| project Computer, AVG_USAGE
But I want to run this query on every hour so that the TimeGenerated should be the last 60 minutes so I want to replace this static value (TimeGenerated from datetime(2020-04-18) to datetime(2020-04-23)) to last 60 minutes in every run.
I tried putting TimeGenerated > ago(60m) as below, but its not taking it
| make-series AVG_USAGE=avg(CounterValue) default=0 on TimeGenerated > ago(60m) step 1h by Computer
Any idea how to place the syntax as last 60 minutes there instead of that fixed Time range.
Apr 24 2020 08:46 AM
How about?
let eTime = now();
let sTime = now(-60m);
Perf
//| project sTime, eTime
| where ObjectName == "Processor" and CounterName == "% Processor Time"
| make-series AVG_USAGE=avg(CounterValue) default=0 on TimeGenerated from sTime to eTime step 1h by Computer
| project Computer, AVG_USAGE
Apr 26 2020 03:02 AM
@CliveWatson Thanks. let me try it once i connect my Azure. Thanks a lot.