SOLVED

Log Analytic Dashboard Diagram(Lines) disk space

%3CLINGO-SUB%20id%3D%22lingo-sub-299644%22%20slang%3D%22en-US%22%3ELog%20Analytic%20Dashboard%20Diagram(Lines)%20disk%20space%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-299644%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20all%3C%2FP%3E%3CP%3EI%20got%20this%20query%20that%20shows%20me%20Used%20disk%20space%20in%20%25%20for%20every%20disk%20in%20the%20vm.%3C%2FP%3E%3CP%3ENow%20i%20want%20to%20collect%20all%20the%20information%20in%20a%20Dashboard%20design%20that%20will%20show%20me%20a%20Diagram(Lines)%20for%20a%20whole%20day%20what%20changes%20been%20made%20and%20when%20in%20a%20past%20day.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThis%20is%20the%20query%20i%20got%20for%20now%20working%2C%20but%20i%20got%20only%20a%20list%20in%20my%20dashboard.%3C%2FP%3E%3CP%3E*******************************************************************************************************%3C%2FP%3E%3CP%3EPerf%3CBR%20%2F%3E%7C%20where%20TimeGenerated%20%26gt%3B%20ago(1h)%3CBR%20%2F%3E%7C%20where%20ObjectName%20%3D%3D%20%22Logical%20Disk%22%20and%20CounterName%20%3D%3D%20%22%25%20Used%20Space%22%3CBR%20%2F%3E%7C%20summarize%20(TimeGenerated%2C%20Used_Space_Percent)%3Darg_max(TimeGenerated%2C%20CounterValue)%20by%20Computer%2C%20InstanceName%3C%2FP%3E%3CP%3E*******************************************************************************************************%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-299644%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%20Log%20Analytics%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EMachine%20Learning%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EQuery%20Language%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EView%20Designer%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-302621%22%20slang%3D%22en-US%22%3ERe%3A%20Log%20Analytic%20Dashboard%20Diagram(Lines)%20disk%20space%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-302621%22%20slang%3D%22en-US%22%3EThanks%2C%20that%20exactly%20what%20i%20need.%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-301885%22%20slang%3D%22en-US%22%3ERe%3A%20Log%20Analytic%20Dashboard%20Diagram(Lines)%20disk%20space%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-301885%22%20slang%3D%22en-US%22%3E%3CP%3EBelow%20query%20should%20help%20you%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CPRE%3EPerf%0A%7C%20where%20TimeGenerated%20%26gt%3B%20ago(1h)%0A%7C%20where%20ObjectName%20%3D%3D%20%22Logical%20Disk%22%20and%20CounterName%20%3D%3D%20%22%25%20Used%20Space%22%0A%7C%20extend%20ComputerDrive%20%3D%20strcat(Computer%2C%20'%20-%20'%2C%20InstanceName)%0A%7C%20summarize%20Used_Space_Percent%20%3D%20max(CounterValue)%20by%20ComputerDrive%2C%20bin(TimeGenerated%2C%201h)%0A%7C%20render%20timechart%20%3C%2FPRE%3E%0A%3CP%3EA%20few%20things%20to%20note%3A%3C%2FP%3E%0A%3CP%3E-%20value%20of%20computer%20and%20drive%20is%20concatenated.%20the%20render%20cannot%20visualize%20more%20than%20one%20column%20at%20a%20time%20this%20we%20create%20a%20single%20column%20out%20of%20those%20two%3C%2FP%3E%0A%3CP%3E-%20I%20am%20using%20bin%20to%20put%20the%20values%20in%20buckets%20in%20time%20range%20of%201%20hour.%20You%20can%20change%20the%20interval%20to%20your%20liking%3C%2FP%3E%0A%3CP%3E-%20I%20am%20using%20max()%20function%20to%20get%20the%20maximum%20value%20available%20for%20each%20hour.%20You%20can%20use%20other%20functions%20like%20min()%2C%20avg()%2C%20percentile()%2C%20etc.%20Depends%20on%20your%20scenario.%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
Occasional Contributor

Hi all

I got this query that shows me Used disk space in % for every disk in the vm.

Now i want to collect all the information in a Dashboard design that will show me a Diagram(Lines) for a whole day what changes been made and when in a past day.

 

This is the query i got for now working, but i got only a list in my dashboard.

*******************************************************************************************************

Perf
| where TimeGenerated > ago(1h)
| where ObjectName == "Logical Disk" and CounterName == "% Used Space"
| summarize (TimeGenerated, Used_Space_Percent)=arg_max(TimeGenerated, CounterValue) by Computer, InstanceName

*******************************************************************************************************

2 Replies
Highlighted
Solution

Below query should help you:

 

Perf
| where TimeGenerated > ago(1h)
| where ObjectName == "Logical Disk" and CounterName == "% Used Space"
| extend ComputerDrive = strcat(Computer, ' - ', InstanceName)
| summarize Used_Space_Percent = max(CounterValue) by ComputerDrive, bin(TimeGenerated, 1h)
| render timechart 

A few things to note:

- value of computer and drive is concatenated. the render cannot visualize more than one column at a time this we create a single column out of those two

- I am using bin to put the values in buckets in time range of 1 hour. You can change the interval to your liking

- I am using max() function to get the maximum value available for each hour. You can use other functions like min(), avg(), percentile(), etc. Depends on your scenario.

Highlighted
Thanks, that exactly what i need.