SOLVED

Getting the rank of a CounterValue

Copper Contributor

I'm having issues designing a query in Log Analytics. My goal is to get the computer's CPU rank out of 100 by comparing it to other LogAnalytics computers.

 

 

let CPUavgOfMyComputer = Perf 
| where Computer contains "myComputerName" 
| where ObjectName == 'Processor' and CounterName == '% Processor Time' and InstanceName == '_Total'
| summarize avg(CounterValue);
Perf
| where ObjectName == 'Processor' and CounterName == '% Processor Time' and InstanceName == '_Total'
| summarize tdigestRes = tdigest(CounterValue), count()
| project rank_tdigest(tdigestRes, CPUavgOfMyComputer) * 100.0 / count_

 

 

I'm pretty sure my issue comes from my syntax on the rank_tdigest function (TDigest, Expr).

 

Can we use a variable for Expr ?

2 Replies
best response confirmed by SebasL (Copper Contributor)
Solution

@SebasL 

 

It was asking for a scalar expression, like this:

 

let CPUavgOfMyComputer = toscalar(Perf 
| where Computer has "name here" 
| where ObjectName == 'Processor' and CounterName == '% Processor Time' and InstanceName == '_Total'
| summarize avg(CounterValue));
Perf
| where ObjectName == 'Processor' and CounterName == '% Processor Time' and InstanceName == '_Total'
| summarize tdigestRes = tdigest(CounterValue), count()
| project rank_tdigest(tdigestRes, CPUavgOfMyComputer) * 100.0 / count_

@CliveWatson 

 

Thanks! that work :cool:

1 best response

Accepted Solutions
best response confirmed by SebasL (Copper Contributor)
Solution

@SebasL 

 

It was asking for a scalar expression, like this:

 

let CPUavgOfMyComputer = toscalar(Perf 
| where Computer has "name here" 
| where ObjectName == 'Processor' and CounterName == '% Processor Time' and InstanceName == '_Total'
| summarize avg(CounterValue));
Perf
| where ObjectName == 'Processor' and CounterName == '% Processor Time' and InstanceName == '_Total'
| summarize tdigestRes = tdigest(CounterValue), count()
| project rank_tdigest(tdigestRes, CPUavgOfMyComputer) * 100.0 / count_

View solution in original post