TimeGenerated challenge

Contributor

Hi Guys,

 

I have this below query which is working fine as expected;

 

Perf

| where ObjectName == "Processor" and CounterName == "% Processor Time"

| make-series AVG_USAGE=avg(CounterValue)  default=0 on TimeGenerated from datetime(2020-04-18) to datetime(2020-04-23) step 1h by Computer

| project Computer,  AVG_USAGE

 

But I want to run this query on every hour so that the TimeGenerated should be the last 60 minutes so I want to replace this static value (TimeGenerated from datetime(2020-04-18) to datetime(2020-04-23)) to last 60 minutes in every run.

I tried putting TimeGenerated > ago(60m) as below, but its not taking it

 

| make-series AVG_USAGE=avg(CounterValue)  default=0 on TimeGenerated > ago(60m)  step 1h by Computer

 

Any idea how to place the syntax as last 60 minutes there instead of that fixed Time range.

2 Replies

@roopesh_shetty 

 

How about?

let eTime = now();
let sTime = now(-60m);
Perf
//| project sTime, eTime
| where ObjectName == "Processor" and CounterName == "% Processor Time"
| make-series AVG_USAGE=avg(CounterValue)  default=0 on TimeGenerated from sTime to eTime step 1h by Computer
| project Computer,  AVG_USAGE

   

@CliveWatson Thanks. let me try it once i connect my Azure. Thanks a lot.