Need to find IP of the vm's from the query

[Alex Kobin]

Need to find IP of the vm's from the query 

Perf

| where ObjectName == "Processor"

| where CounterName == "% Processor Time"

| where InstanceName == "_Total"

| where CounterValue > 95

what do i need to add?

[#2 · Accepted solution]

Hi

The following query will give you the name and the IP of each computer that is produced in the query.

let ComputerList = Perf
| where ObjectName == "Processor"
| where CounterName == "% Processor Time"
| where InstanceName == "_Total"
| where CounterValue > 95 | distinct Computer;
Heartbeat | where Computer in (ComputerList) | project Computer, ComputerIP 

Keep in mind that your query is not detecting if certain computers are reaching high CPU utilization. Instead it is getting just point in times when the CPU was high. This will return computers that overall had low cpu usage but just one time for a few seconds their CPU was high.