Aug 24 2021
- last edited on
Apr 08 2022
I would like to run a query based on the performance counter ObjectName == "TCPv4" and CounterName == "Connection Failures"
This counter displays the TCP Failure number but its particularity is that the counter is incremental.
I would like, with my query, to get only the incremental between two data points.
Let's say my counter is every 300 seconds (5m), how can I have a column with the value incremented every 300 or 600 seconds?
My current query look like this. I've looked to a way of using some kind on Summarize operator without success.
| where Computer =~ "MyComputerName"
| where ObjectName == "TCPv4" and CounterName == "Connection Failures"
| project TimeGenerated, Computer, ObjectName, CounterName, CounterValue
Aug 26 2021 07:12 AM - edited Aug 26 2021 07:26 AMSolution
You can use the prev command. In this example, we look at free space on the C: volume on a computer named Idala. We compare the previous counter value with the current one. We also do a CASE to write different text strings based on the current free space.
| where Computer == "idala"
| where CounterName == "% Free Space"
| where InstanceName == "C:"
| serialize | extend prevValue = prev(CounterValue, 1)
| extend diffvalue = CounterValue - prevValue
| extend trend = case(CounterValue < prevValue, "Free Space Reduces",
CounterValue > prevValue, "Free Space Increases",
| project TimeGenerated, InstanceName, CounterValue, prevValue, diffvalue, trend
| order by TimeGenerated desc
Aug 26 2021 08:07 AM