SOLVED

Behaviour different from old OMS to new Azure Portal

%3CLINGO-SUB%20id%3D%22lingo-sub-279649%22%20slang%3D%22en-US%22%3EBehaviour%20different%20from%20old%20OMS%20to%20new%20Azure%20Portal%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-279649%22%20slang%3D%22en-US%22%3E%3CP%3EI%20have%20a%20query%20that%20show%26nbsp%3Bhigh%20consumption%20disk.%20In%20old%20OMS%20Portal%2C%20it%26nbsp%3Brender%20timechart%20detailed%20by%20each%20%22Instance%20Name%22.%20In%20new%20portal%2C%20it%20sums%20all%20%22instance%20name%22%20(see%20attached%20screenshots)%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHow%20can%20I%20show%20summarise%20by%20multiple%20fields%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CDIV%3E%3CDIV%3E%3CSPAN%3EPerf%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3E%7C%20%3C%2FSPAN%3E%3CSPAN%3Ewhere%3C%2FSPAN%3E%3CSPAN%3E%20ObjectName%20%3D%3D%20%3C%2FSPAN%3E%3CSPAN%3E%22Logical%20Disk%22%3C%2FSPAN%3E%20%3CSPAN%3Eand%3C%2FSPAN%3E%3CSPAN%3E%20CounterName%20%3D%3D%20%3C%2FSPAN%3E%3CSPAN%3E%22%25%20Used%20Space%22%3C%2FSPAN%3E%20%3CSPAN%3Eand%3C%2FSPAN%3E%3CSPAN%3E%20InstanceName%20!%3D%20%3C%2FSPAN%3E%3CSPAN%3E%22_Total%22%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3E%7C%20%3C%2FSPAN%3E%3CSPAN%3Esummarize%3C%2FSPAN%3E%3CSPAN%3E%20AggregatedValue%20%3D%20avg(CounterValue)%20%3C%2FSPAN%3E%3CSPAN%3Eby%3C%2FSPAN%3E%3CSPAN%3E%20bin(TimeGenerated%2C%20%3C%2FSPAN%3E%3CSPAN%3E15%3C%2FSPAN%3E%3CSPAN%3Em)%2C%20Computer%2CInstanceName%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3E%7C%20%3C%2FSPAN%3E%3CSPAN%3Ewhere%3C%2FSPAN%3E%3CSPAN%3E%20AggregatedValue%20%26gt%3B%20%3C%2FSPAN%3E%3CSPAN%3E60%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3E%7C%20%3C%2FSPAN%3E%3CSPAN%3Erender%3C%2FSPAN%3E%3CSPAN%3E%20timechart%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%3C%2FDIV%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-279649%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%20Log%20Analytics%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-281684%22%20slang%3D%22en-US%22%3ERe%3A%20Behaviour%20different%20from%20old%20OMS%20to%20new%20Azure%20Portal%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-281684%22%20slang%3D%22en-US%22%3E%3CP%3EHi%2C%3CBR%20%2F%3EUnfortunately%20this%20functionality%20is%20not%20present%20in%20Azure%20Portal%20and%20I%20have%20given%20that%20feedback%20before.%20The%20easiest%20but%20not%20preatty%20way%20to%20do%20this%20is%20to%20concat%20different%20columns%20together.%20I%20have%20demonstrated%20that%20approach%20on%20a%20blog%20post%20about%20alerts%20but%20applies%20to%20visualization%20as%20well.%20%3CA%20href%3D%22https%3A%2F%2Fcloudadministrator.net%2F2018%2F06%2F08%2Faggregate-on-more-than-one-column-for-azure-log-search-alerts%2F%22%20target%3D%22_self%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fcloudadministrator.net%2F2018%2F06%2F08%2Faggregate-on-more-than-one-column-for-azure-log-search-alerts%2F%3C%2FA%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E
Regular Visitor

I have a query that show high consumption disk. In old OMS Portal, it render timechart detailed by each "Instance Name". In new portal, it sums all "instance name" (see attached screenshots)

 

How can I show summarise by multiple fields

 

Perf
| where ObjectName == "Logical Disk" and CounterName == "% Used Space" and InstanceName != "_Total"
| summarize AggregatedValue = avg(CounterValue) by bin(TimeGenerated, 15m), Computer,InstanceName
| where AggregatedValue > 60
| render timechart
 
 
1 Reply
best response confirmed by Stanislav Zhelyazkov (MVP)
Solution

Hi,
Unfortunately this functionality is not present in Azure Portal and I have given that feedback before. The easiest but not preatty way to do this is to concat different columns together. I have demonstrated that approach on a blog post about alerts but applies to visualization as well. https://cloudadministrator.net/2018/06/08/aggregate-on-more-than-one-column-for-azure-log-search-ale...