Aug 07 2018
01:04 AM
- last edited on
Apr 07 2022
05:25 PM
by
TechCommunityAP
Aug 07 2018
01:04 AM
- last edited on
Apr 07 2022
05:25 PM
by
TechCommunityAP
Aug 07 2018 02:46 AM - edited Aug 07 2018 02:48 AM
SolutionHi Dapeng Li,
Put shortly - once you apply the first `summarize` by instance name and computer, you lose the TimeGenerated column. I suggest you add the "bin" you use on the second `summarize` to the first one.
Additionally, when you use "join" you might over-complicate the query, and make it less efficient.
I suggest the following query (changed the first string to match our demo data)
let containerNames = Perf | where InstanceName like 'e4272367-5645-4c4e-9c67-3b74b59a6982' | where ObjectName == 'K8SContainer' | where CounterName == "memoryRssBytes" | distinct InstanceName; Perf | where InstanceName in (containerNames) | where CounterName == "memoryRssBytes" | extend usage = tolong(CounterValue) | extend usageMB = usage * 1.0/(1024*1024) | summarize maxUsageMB=max(usageMB) by InstanceName, Computer, bin(TimeGenerated, 2h) | summarize sum(maxUsageMB) by Computer, bin(TimeGenerated, 2h)
HTH,
Noa
Aug 12 2018 06:40 PM
Aug 07 2018 02:46 AM - edited Aug 07 2018 02:48 AM
SolutionHi Dapeng Li,
Put shortly - once you apply the first `summarize` by instance name and computer, you lose the TimeGenerated column. I suggest you add the "bin" you use on the second `summarize` to the first one.
Additionally, when you use "join" you might over-complicate the query, and make it less efficient.
I suggest the following query (changed the first string to match our demo data)
let containerNames = Perf | where InstanceName like 'e4272367-5645-4c4e-9c67-3b74b59a6982' | where ObjectName == 'K8SContainer' | where CounterName == "memoryRssBytes" | distinct InstanceName; Perf | where InstanceName in (containerNames) | where CounterName == "memoryRssBytes" | extend usage = tolong(CounterValue) | extend usageMB = usage * 1.0/(1024*1024) | summarize maxUsageMB=max(usageMB) by InstanceName, Computer, bin(TimeGenerated, 2h) | summarize sum(maxUsageMB) by Computer, bin(TimeGenerated, 2h)
HTH,
Noa