TimeGenerated challenge

%3CLINGO-SUB%20id%3D%22lingo-sub-1335189%22%20slang%3D%22en-US%22%3ETimeGenerated%20challenge%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1335189%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20Guys%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20have%20this%20below%20query%20which%20is%20working%20fine%20as%20expected%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSTRONG%3EPerf%3C%2FSTRONG%3E%3C%2FP%3E%3CP%3E%3CSTRONG%3E%7C%20where%20ObjectName%20%3D%3D%20%22Processor%22%20and%20CounterName%20%3D%3D%20%22%25%20Processor%20Time%22%3C%2FSTRONG%3E%3C%2FP%3E%3CP%3E%3CSTRONG%3E%7C%20make-series%20AVG_USAGE%3Davg(CounterValue)%26nbsp%3B%20default%3D0%20on%20TimeGenerated%20from%20datetime(2020-04-18)%20to%20datetime(2020-04-23)%20step%201h%20by%20Computer%3C%2FSTRONG%3E%3C%2FP%3E%3CP%3E%3CSTRONG%3E%7C%20project%20Computer%2C%26nbsp%3B%20AVG_USAGE%3C%2FSTRONG%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EBut%20I%20want%20to%20run%20this%20query%20on%20every%20hour%20so%20that%20the%20TimeGenerated%20should%20be%20the%20last%2060%20minutes%20so%20I%20want%20to%20replace%20this%20static%20value%20(%3CSTRONG%3ETimeGenerated%20from%20datetime(2020-04-18)%20to%20datetime(2020-04-23))%3C%2FSTRONG%3E%20to%20last%2060%20minutes%20in%20every%20run.%3C%2FP%3E%3CP%3EI%20tried%20putting%20%3CSTRONG%3ETimeGenerated%20%26gt%3B%20ago(60m)%20%3C%2FSTRONG%3Eas%20below%2C%20but%20its%20not%20taking%20it%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSTRONG%3E%7C%20make-series%20AVG_USAGE%3Davg(CounterValue)%26nbsp%3B%20default%3D0%20on%20TimeGenerated%20%26gt%3B%20ago(60m)%20%26nbsp%3Bstep%201h%20by%20Computer%3C%2FSTRONG%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAny%20idea%20how%20to%20place%20the%20syntax%20as%20last%2060%20minutes%20there%20instead%20of%20that%20fixed%20Time%20range.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1335189%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%20Log%20Analytics%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EQuery%20Language%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1335989%22%20slang%3D%22en-US%22%3ERe%3A%20TimeGenerated%20challenge%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1335989%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F338025%22%20target%3D%22_blank%22%3E%40roopesh_shetty%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EHow%20about%3F%3C%2FP%3E%0A%3CPRE%20class%3D%22lia-code-sample%20language-cpp%22%3E%3CCODE%3Elet%20eTime%20%3D%20now()%3B%0Alet%20sTime%20%3D%20now(-60m)%3B%0APerf%0A%2F%2F%7C%20project%20sTime%2C%20eTime%0A%7C%20where%20ObjectName%20%3D%3D%20%22Processor%22%20and%20CounterName%20%3D%3D%20%22%25%20Processor%20Time%22%0A%7C%20make-series%20AVG_USAGE%3Davg(CounterValue)%20%20default%3D0%20on%20TimeGenerated%20from%20sTime%20to%20eTime%20step%201h%20by%20Computer%0A%7C%20project%20Computer%2C%20%20AVG_USAGE%3C%2FCODE%3E%3C%2FPRE%3E%0A%3CP%3E%26nbsp%3B%20%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1338432%22%20slang%3D%22en-US%22%3ERe%3A%20TimeGenerated%20challenge%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1338432%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F239477%22%20target%3D%22_blank%22%3E%40Clive%20Watson%3C%2FA%3E%26nbsp%3BThanks.%20let%20me%20try%20it%20once%20i%20connect%20my%20Azure.%20Thanks%20a%20lot.%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
Contributor

Hi Guys,

 

I have this below query which is working fine as expected;

 

Perf

| where ObjectName == "Processor" and CounterName == "% Processor Time"

| make-series AVG_USAGE=avg(CounterValue)  default=0 on TimeGenerated from datetime(2020-04-18) to datetime(2020-04-23) step 1h by Computer

| project Computer,  AVG_USAGE

 

But I want to run this query on every hour so that the TimeGenerated should be the last 60 minutes so I want to replace this static value (TimeGenerated from datetime(2020-04-18) to datetime(2020-04-23)) to last 60 minutes in every run.

I tried putting TimeGenerated > ago(60m) as below, but its not taking it

 

| make-series AVG_USAGE=avg(CounterValue)  default=0 on TimeGenerated > ago(60m)  step 1h by Computer

 

Any idea how to place the syntax as last 60 minutes there instead of that fixed Time range.

2 Replies
Highlighted

@roopesh_shetty 

 

How about?

let eTime = now();
let sTime = now(-60m);
Perf
//| project sTime, eTime
| where ObjectName == "Processor" and CounterName == "% Processor Time"
| make-series AVG_USAGE=avg(CounterValue)  default=0 on TimeGenerated from sTime to eTime step 1h by Computer
| project Computer,  AVG_USAGE

   

Highlighted

@Clive Watson Thanks. let me try it once i connect my Azure. Thanks a lot.