Creating an azure monitor alert from log analytics with scalar values

%3CLINGO-SUB%20id%3D%22lingo-sub-2396310%22%20slang%3D%22en-US%22%3ECreating%20an%20azure%20monitor%20alert%20from%20log%20analytics%20with%20scalar%20values%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2396310%22%20slang%3D%22en-US%22%3E%3CP%3EI%20want%20to%20create%20an%20alert%20based%20on%20a%20specific%20counter%20not%20increasing.%26nbsp%3B%20ie%20in%20the%20query%20below%2C%20I%20want%20to%20be%20able%20to%20create%20an%20alert%20if%20m1-m2%20is%20ever%20zero.%26nbsp%3B%20ie%20the%20counter%20I'm%20recording%20in%20Log%20Analytics%20does%20not%20increase%20over%20time.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAny%20thoughts%20on%20how%20I%20might%20do%20this%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Elet%20m1%20%3D%20toscalar(customMonitoring_CL%3CBR%20%2F%3E%7C%20where%20nodeName_s%20%3D%3D%20'test1'%3CBR%20%2F%3E%7C%20where%20TimeGenerated%20between(ago(5m)..now())%3CBR%20%2F%3E%7C%20top%201%20by%20nodeName_s%3CBR%20%2F%3E%7C%20project%20counter_d)%3B%3CBR%20%2F%3Elet%20m2%20%3D%20toscalar(customMonitoring_CL%3CBR%20%2F%3E%7C%20where%20nodeName_s%20%3D%3D%20'test2'%3CBR%20%2F%3E%7C%20where%20TimeGenerated%20between(ago(10m)..ago(5m))%3CBR%20%2F%3E%7C%20top%201%20by%20nodeName_s%3CBR%20%2F%3E%7C%20project%20counter_d)%3B%3CBR%20%2F%3Eprint%20m1-m2%3C%2FP%3E%3C%2FLINGO-BODY%3E
Occasional Contributor

I want to create an alert based on a specific counter not increasing.  ie in the query below, I want to be able to create an alert if m1-m2 is ever zero.  ie the counter I'm recording in Log Analytics does not increase over time.

 

Any thoughts on how I might do this?

 

let m1 = toscalar(customMonitoring_CL
| where nodeName_s == 'test1'
| where TimeGenerated between(ago(5m)..now())
| top 1 by nodeName_s
| project counter_d);
let m2 = toscalar(customMonitoring_CL
| where nodeName_s == 'test2'
| where TimeGenerated between(ago(10m)..ago(5m))
| top 1 by nodeName_s
| project counter_d);
print m1-m2

0 Replies