Jan 15 2018
05:28 AM
- last edited on
Apr 07 2022
04:51 PM
by
TechCommunityAP
Jan 15 2018
05:28 AM
- last edited on
Apr 07 2022
04:51 PM
by
TechCommunityAP
Hi all,
I'm trying to learn the language and I want to search multiple perf counters on all connected computers, but I don't understand how.
for example:
Perf | where (CounterName == "% Committed Bytes In Use" or CounterName == "% Used Memory") | where CounterName == "% Committed Bytes In Use" | summarize AggregatedValue = avg(CounterValue) by Computer | sort by Computer desc
How do I add CPU % Processor Time to the query as a new column?
Thanks in advance.
Jan 15 2018 07:35 AM
SolutionHey Dante,
Try this query, it shows a number of perf counters, and the average calculated per computer and counter name. The results show the counter name in a separate column.
Is this what you were looking for?
Jan 15 2018 10:39 AM
Jan 15 2018 10:53 AM
Jan 16 2018 03:43 AM
Yes, you can do it this way.
Note that I used join kind "fullouter" to includes all records, while the default join behavior is to show only records that match and exists on both left and right tables.
Jan 16 2018 06:53 AM
Thank you for all your help.
What is the project-away cmlet?
Thank you!
Jan 17 2018 11:17 AM
project-away actually excludes field from the results. After join, fields that have the same name in both table (such as the field you join on) are shown as "Fieldname" and "Fieldname1". If you want remove one of them from the result set, project-away is the easiest way.
Jan 23 2018 05:44 AM
Hi Noa,
Is it in some way possible to use a matcher like contains or has in place of in?
...
Jan 23 2018 08:49 AM
Hi Henrik,
To check if a string contain any of a given list of values, you'd need to a evaluation each value separately, like this:
Perf | where CounterName contains "% Committed"
or CounterName contains "% Used Mem"
or CounterName contains "% Proc" | summarize AggregatedValue = avg(CounterValue) by Computer, CounterName
The only string operator that accepts a list of values is "in". See the full list of string operators here.
Regards,
Noa
Feb 20 2019 07:09 PM
There is no Performance counter called % Used Memory in windows..I am also trying to find out how to get the Percentage of Memory used within 12 hours time...slice window of 1 hour .Please let me know if anyone has the query for this
Thanks
R
@Noa Kuperberg wrote:Hi Henrik,
To check if a string contain any of a given list of values, you'd need to a evaluation each value separately, like this:
Perf | where CounterName contains "% Committed"
or CounterName contains "% Used Mem"
or CounterName contains "% Proc" | summarize AggregatedValue = avg(CounterValue) by Computer, CounterNameThe only string operator that accepts a list of values is "in". See the full list of string operators here.
Regards,
Noa
@Noa Kuperberg wrote:Hi Henrik,
To check if a string contain any of a given list of values, you'd need to a evaluation each value separately, like this:
Perf | where CounterName contains "% Committed"
or CounterName contains "% Used Mem"
or CounterName contains "% Proc" | summarize AggregatedValue = avg(CounterValue) by Computer, CounterNameThe only string operator that accepts a list of values is "in". See the full list of string operators here.
Regards,
Noa
Jun 23 2021 01:22 PM
Jun 24 2021 01:25 AM
You need a way to identify the servers by their type, here I'm using the computer name in a few ways (just to show some of the options you can use), to find the computer type and then assign a value and a default value. You may have another identifier other than computer name, but you can use a "case" on that data, like this example:
Perf
| where TimeGenerated > ago(1h)
| summarize by Computer, CounterName, CounterValue
| extend groupThreshold_ = case
(
Computer startswith "THAM", 10,
Computer endswith "01",70,
Computer has "aks",60,
Computer contains "RDS",65,
//else use default value
50
)
| where CounterName == "% Committed Bytes In Use"
| summarize avg = avg(CounterValue) by Computer, groupThreshold_
| where avg > groupThreshold_
Jun 24 2021 02:55 AM
Jan 15 2018 07:35 AM
SolutionHey Dante,
Try this query, it shows a number of perf counters, and the average calculated per computer and counter name. The results show the counter name in a separate column.
Is this what you were looking for?