SOLVED

Why does the same query return different results in two charts?

%3CLINGO-SUB%20id%3D%22lingo-sub-1584481%22%20slang%3D%22en-US%22%3EWhy%20does%20the%20same%20query%20return%20different%20results%20in%20two%20charts%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1584481%22%20slang%3D%22en-US%22%3E%3CP%3EI%20am%20monitoring%20Windows%20and%20Linux%20VMs.%20The%20windows%20VM's%20are%20out%20of%20100%25%20but%20the%20Linux%20goes%20over%3F%20Why%20is%20that%3F%20Isn't%20percentage%20supposed%20to%20be%20out%20of%20100%25%3F%20They%20are%20using%20the%20same%20queries.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EWindows%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22within100.png%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F212044iE92142D0AC92B332%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20title%3D%22within100.png%22%20alt%3D%22within100.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3ELinux%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22over100.PNG%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F212043iD2A90070A1FEF9DD%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20title%3D%22over100.PNG%22%20alt%3D%22over100.PNG%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1584481%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3ECustom%20Logs%20and%20Custom%20Fields%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3Edashboards%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3ELog%20Analytics%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EMetrics%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1591289%22%20slang%3D%22en-US%22%3ERe%3A%20Why%20does%20the%20same%20query%20return%20different%20results%20in%20two%20charts%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1591289%22%20slang%3D%22en-US%22%3E%3CP%3EHi%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F741656%22%20target%3D%22_blank%22%3E%40Jhilene%3C%2FA%3E%2C%3C%2FP%3E%0A%3CP%3EThat's%20most%20likely%20because%20multiple%20values%20were%20logged%20at%20the%20same%20time%2C%20and%20summed%20up%20on%20the%20chart%20you%20created.%20I%20see%20that%20your%20query%20filters%20by%20computer%20starting%20with%20a%20string%2C%20and%20that%20means%20you're%20probabaly%20getting%20back%20reports%20of%20multiple%20computers.%3C%2FP%3E%0A%3CP%3EThere%20are%20a%20number%20of%20solutions%2C%20depending%20on%20what%20you%20want%20to%20chart%3A%3C%2FP%3E%0A%3CP%3E1.%20You%20can%20chart%20the%20average%2C%20maximum%20or%20minimum%20values%20of%20the%20reports%20by%20selecting%20a%20different%20option%20on%20this%20dropdown%2C%20instead%20of%20Sum%3A%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22sum.png%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F212642iCD807A395EC16D11%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20title%3D%22sum.png%22%20alt%3D%22sum.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E2.%20You%20can%20change%20the%20filter%20to%20a%20specific%20computer%20name%2C%20which%20will%20assure%20you're%20not%20getting%20many%20values%20with%20the%20same%20TimeGenerated%20value%3C%2FP%3E%0A%3CP%3E3.%20You%20can%20use%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fazure%2Fdata-explorer%2Fkusto%2Fquery%2Fsummarizeoperator%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%22%3Esummarize%3C%2FA%3E%20to%20calculate%20something%20different%20(use%20with%20'bin'%20to%20set%20a%20fixed%20bin%20size%20of%2010%20minutes%20for%20example)%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EHTH%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1611098%22%20slang%3D%22en-US%22%3ERe%3A%20Why%20does%20the%20same%20query%20return%20different%20results%20in%20two%20charts%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1611098%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F54923%22%20target%3D%22_blank%22%3E%40Noa%20Kuperberg%3C%2FA%3E%26nbsp%3BI%20realized%20this.%20Thank%20you%20so%20much%20for%20your%20detailed%20explanation.%3C%2FP%3E%3C%2FLINGO-BODY%3E
Microsoft

I am monitoring Windows and Linux VMs. The windows VM's are out of 100% but the Linux goes over? Why is that? Isn't percentage supposed to be out of 100%? They are using the same queries.

 

Windows

 within100.png

Linux

 over100.PNG

2 Replies
Best Response confirmed by Jhilene (Microsoft)
Solution

Hi @Jhilene,

That's most likely because multiple values were logged at the same time, and summed up on the chart you created. I see that your query filters by computer starting with a string, and that means you're probabaly getting back reports of multiple computers.

There are a number of solutions, depending on what you want to chart:

1. You can chart the average, maximum or minimum values of the reports by selecting a different option on this dropdown, instead of Sum:

sum.png

2. You can change the filter to a specific computer name, which will assure you're not getting many values with the same TimeGenerated value

3. You can use summarize to calculate something different (use with 'bin' to set a fixed bin size of 10 minutes for example)

 

HTH

 

@Noa Kuperberg I realized this. Thank you so much for your detailed explanation.