Further help with query - amending the threshold more

%3CLINGO-SUB%20id%3D%22lingo-sub-1487152%22%20slang%3D%22en-US%22%3EFurther%20help%20with%20query%20-%20amending%20the%20threshold%20more%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1487152%22%20slang%3D%22en-US%22%3E%3CP%3EPerf%3C%2FP%3E%3CP%3E%2F%2F%20set%20up%20filters%3C%2FP%3E%3CP%3E%7C%20where%20ObjectName%20%3D%3D%20%22LogicalDisk%22%20and%20CounterName%20%3D%3D%20%22%25%20Free%20Space%22%3C%2FP%3E%3CP%3E%7C%20where%20strlen(InstanceName)%20%3D%3D%202%20and%20InstanceName%20contains%20%22%3A%22%3C%2FP%3E%3CP%3E%2F%2F%20exclude%20ALL%20these%20named%20computers%3C%2FP%3E%3CP%3E%7C%20where%20Computer%20!in%20(%22net-fs3.networkhg.org.uk%22%2C%22NET-FS1.networkhg.org.uk%22%2C%22NET-SQL3.networkhg.org.uk%22%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%20%22NET-EDMLIVEDB1.networkhg.org.uk%22%2C%22NET-EDM_KOFAX1.networkhg.org.uk%22)%3C%2FP%3E%3CP%3E%2F%2F%20Show%20all%3C%2FP%3E%3CP%3E%7C%20summarize%20Free_Space%20%3D%20min(CounterValue)%20by%20Computer%20%2C%20InstanceName%3C%2FP%3E%3CP%3E%2F%2F%20Exclude%20these%20drive%20%2F%20Computer%20combinations%3C%2FP%3E%3CP%3E%2F%2F%20Use%20a%20%221%22%20to%20denaote%20an%20exclude%20else%20%220%22%3C%2FP%3E%3CP%3E%7C%20extend%20ComputerList%20%3D%20case(%3C%2FP%3E%3CP%3E%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%20Computer%20%3D%3D%20%22NET-REPAIR2.networkhg.org.uk%22%20and%20InstanceName%20%3D%3D%20%22E%3A%22%2C1%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%20%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3BComputer%20%3D%3D%20%22NH-E2016-01.networkhg.org.uk%22%20and%20InstanceName%20%3D%3D%20%22E%3A%22%2C1%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%20Computer%20%3D%3D%20%22NH-E2016-02.networkhg.org.uk%22%20and%20InstanceName%20%3D%3D%20%22E%3A%22%2C1%2C%26nbsp%3B%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%20Computer%20%3D%3D%20%22net-boxi1.networkhg.org.uk%22%26nbsp%3B%26nbsp%3B%20and%20InstanceName%20%3D%3D%20%22D%3A%22%2C1%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%20%2F%2Felse%20zero%3C%2FP%3E%3CP%3E%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%200)%3C%2FP%3E%3CP%3E%7C%20where%20ComputerList%20!%3D1%3C%2FP%3E%3CP%3E%7C%20where%20Free_Space%20%26lt%3B%2010%3C%2FP%3E%3CP%3E%7C%20project-away%20ComputerList%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20need%20assistance%20with%20amending%20the%20query%20further%20and%20make%20it%20more%20automated.%20I%20would%20like%20to%20avoid%20another%20computer%20within%20this%20command%2C%20for%20instance%20G%20drive%20and%20I%20want%20this%20to%20be%20monitored%20for%20less%20then%206%20%25%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIs%20it%20possible%20to%20be%20done%20within%20the%20same%20query%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1487152%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3Ekql%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E
Contributor

Perf

// set up filters

| where ObjectName == "LogicalDisk" and CounterName == "% Free Space"

| where strlen(InstanceName) == 2 and InstanceName contains ":"

// exclude ALL these named computers

| where Computer !in ("net-fs3.networkhg.org.uk","NET-FS1.networkhg.org.uk","NET-SQL3.networkhg.org.uk",

                   "NET-EDMLIVEDB1.networkhg.org.uk","NET-EDM_KOFAX1.networkhg.org.uk")

// Show all

| summarize Free_Space = min(CounterValue) by Computer , InstanceName

// Exclude these drive / Computer combinations

// Use a "1" to denaote an exclude else "0"

| extend ComputerList = case(

                           Computer == "NET-REPAIR2.networkhg.org.uk" and InstanceName == "E:",1,

                          Computer == "NH-E2016-01.networkhg.org.uk" and InstanceName == "E:",1,

                           Computer == "NH-E2016-02.networkhg.org.uk" and InstanceName == "E:",1,  

                           Computer == "net-boxi1.networkhg.org.uk"   and InstanceName == "D:",1,

                           //else zero

                           0)

| where ComputerList !=1

| where Free_Space < 10

| project-away ComputerList

 

 

I need assistance with amending the query further and make it more automated. I would like to avoid another computer within this command, for instance G drive and I want this to be monitored for less then 6 %

 

Is it possible to be done within the same query

0 Replies