Does this query CPU percentage or something else ?

[bkislay]

We are using the following query to determine CPU Percentage and raise alert, but I am not sure if this is the right query : 

Perf
| where _ResourceId !contains "prep" and _ResourceId !contains "demo"
| where _ResourceId contains "abc"
| where ObjectName == "Processor" and CounterName == "% Processor Time"
| summarize AggregatedValue = avg(CounterValue) by bin_at(TimeGenerated, 30m), Computer
| where AggregatedValue > 90

[#2 · Accepted solution]

@bkislay 

You can also look at percentiles https://docs.microsoft.com/en-gb/azure/data-explorer/kusto/query/percentiles-aggfunction#examples (see 2nd example) and the other CPU example in the UI

// CPU usage trends over the last day 
// Calculate CPU usage patterns across all computers, chart by percentiles. 
Perf
| where ObjectName == "Processor" and CounterName == "% Processor Time" and InstanceName == "_Total"
| summarize percentiles(CounterValue, 50, 90, 99) by bin(TimeGenerated, 1h)
| render timechart

 You can amend the above (see below), as the trend is sometimes better than the average to look at - but this depends on your requirement 

// CPU usage trends over the last day 
// Calculate CPU usage patterns across all computers, chart by percentiles. 
Perf
| where ObjectName == "Processor" and CounterName == "% Processor Time" and InstanceName == "_Total"
| summarize percentiles(CounterValue, 50, 90, 99) by bin(TimeGenerated, 1h), Computer