May 23 2019
- last edited on
Apr 07 2022
I am trying to gather heartbeat result of all computers, but for specific hours on workweek and excluding the weekends and holidays. So far, I am able to aggregate total hours of time and total uptime of all vm , but due to schedule off time, the result coming with low % uptime value. I would like to filter the production hours..
May 24 2019 02:41 AM - edited May 24 2019 02:44 AM
Snip, to show how to only get data from between 9:00 and 17:00 as an example
let StartTime =startofday(ago(30d)); let EndTime =endofday(ago(10m)); let prodhourstart = 9; let prodhourend = 17; Heartbeat | where TimeGenerated > StartTime and TimeGenerated < EndTime | extend bythehour = datetime_part("hour", TimeGenerated) | where bythehour between (prodhourstart .. prodhourend)