SOLVED

Getting the rank of a CounterValue

%3CLINGO-SUB%20id%3D%22lingo-sub-1745512%22%20slang%3D%22en-US%22%3EGetting%20the%20rank%20of%20a%20CounterValue%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1745512%22%20slang%3D%22en-US%22%3E%3CP%3EI'm%20having%20issues%20designing%20a%20query%20in%20Log%20Analytics.%20My%20goal%20is%20to%20get%20the%20computer's%20CPU%20rank%20out%20of%20100%20by%20comparing%20it%20to%20other%20LogAnalytics%20computers.%3C%2FP%3E%3CDIV%3E%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%3C%2FDIV%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CPRE%20class%3D%22lia-code-sample%20language-applescript%22%3E%3CCODE%3Elet%20CPUavgOfMyComputer%20%3D%20Perf%20%0A%7C%20where%20Computer%20contains%20%22myComputerName%22%20%0A%7C%20where%20ObjectName%20%3D%3D%20'Processor'%20and%20CounterName%20%3D%3D%20'%25%20Processor%20Time'%20and%20InstanceName%20%3D%3D%20'_Total'%0A%7C%20summarize%20avg(CounterValue)%3B%0APerf%0A%7C%20where%20ObjectName%20%3D%3D%20'Processor'%20and%20CounterName%20%3D%3D%20'%25%20Processor%20Time'%20and%20InstanceName%20%3D%3D%20'_Total'%0A%7C%20summarize%20tdigestRes%20%3D%20tdigest(CounterValue)%2C%20count()%0A%7C%20project%20rank_tdigest(tdigestRes%2C%20CPUavgOfMyComputer)%20*%20100.0%20%2F%20count_%3C%2FCODE%3E%3C%2FPRE%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI'm%20pretty%20sure%20my%20issue%20comes%20from%20my%20syntax%20on%20the%20%3CEM%3E%3CSTRONG%3Erank_tdigest%3C%2FSTRONG%3E%3C%2FEM%3E%20function%20(TDigest%2C%20%3CFONT%20color%3D%22%23FF0000%22%3EExpr%3C%2FFONT%3E).%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ECan%20we%20use%20a%20variable%20for%20%3CEM%3EExpr%3C%2FEM%3E%20%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1746584%22%20slang%3D%22en-US%22%3ERe%3A%20Getting%20the%20rank%20of%20a%20CounterValue%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1746584%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F555969%22%20target%3D%22_blank%22%3E%40SebasL%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EIt%20was%20asking%20for%20a%20scalar%20expression%2C%20like%20this%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CPRE%20class%3D%22lia-code-sample%20language-cpp%22%3E%3CCODE%3Elet%20CPUavgOfMyComputer%20%3D%20toscalar(Perf%20%0A%7C%20where%20Computer%20has%20%22name%20here%22%20%0A%7C%20where%20ObjectName%20%3D%3D%20'Processor'%20and%20CounterName%20%3D%3D%20'%25%20Processor%20Time'%20and%20InstanceName%20%3D%3D%20'_Total'%0A%7C%20summarize%20avg(CounterValue))%3B%0APerf%0A%7C%20where%20ObjectName%20%3D%3D%20'Processor'%20and%20CounterName%20%3D%3D%20'%25%20Processor%20Time'%20and%20InstanceName%20%3D%3D%20'_Total'%0A%7C%20summarize%20tdigestRes%20%3D%20tdigest(CounterValue)%2C%20count()%0A%7C%20project%20rank_tdigest(tdigestRes%2C%20CPUavgOfMyComputer)%20*%20100.0%20%2F%20count_%3C%2FCODE%3E%3C%2FPRE%3E%3C%2FLINGO-BODY%3E
Occasional Contributor

I'm having issues designing a query in Log Analytics. My goal is to get the computer's CPU rank out of 100 by comparing it to other LogAnalytics computers.

 

 

let CPUavgOfMyComputer = Perf 
| where Computer contains "myComputerName" 
| where ObjectName == 'Processor' and CounterName == '% Processor Time' and InstanceName == '_Total'
| summarize avg(CounterValue);
Perf
| where ObjectName == 'Processor' and CounterName == '% Processor Time' and InstanceName == '_Total'
| summarize tdigestRes = tdigest(CounterValue), count()
| project rank_tdigest(tdigestRes, CPUavgOfMyComputer) * 100.0 / count_

 

 

I'm pretty sure my issue comes from my syntax on the rank_tdigest function (TDigest, Expr).

 

Can we use a variable for Expr ?

2 Replies
best response confirmed by SebasL (Occasional Contributor)
Solution

@SebasL 

 

It was asking for a scalar expression, like this:

 

let CPUavgOfMyComputer = toscalar(Perf 
| where Computer has "name here" 
| where ObjectName == 'Processor' and CounterName == '% Processor Time' and InstanceName == '_Total'
| summarize avg(CounterValue));
Perf
| where ObjectName == 'Processor' and CounterName == '% Processor Time' and InstanceName == '_Total'
| summarize tdigestRes = tdigest(CounterValue), count()
| project rank_tdigest(tdigestRes, CPUavgOfMyComputer) * 100.0 / count_

@Clive Watson 

 

Thanks! that work :cool: