Calculating rate of change in Log Analytics

Brass Contributor

Sep 12, 2019

CliveWatson Thanks for the reply. I have looked at that. It's not the number of new entries per minute I am trying to ascertain, but the change in the sum of all previous entries per minute, if that makes sense.

ie in the above query, you'll see system mode cpu usage for computer aks-agentpool-31816283-2 goes from 264552.21 to 264560.83 in the minute, so i want the difference between those 2 on an on-going basis. In fact, I actually want it for all modes but one step at a time.

santhoshparepu
Copper Contributor
Dec 30, 2019
Peter Hall Did you find out prometheus "rate" equivalent function in kusto
- ehuggz
  Copper Contributor
  Sep 07, 2022
  santhoshparepu For anyone still looking for a Prometheus equivalent to rate of change the link below defines a Kusto User Defined Function to calculate rate of change from a Prometheus style counter which can only go up, unless reset. https://docs.microsoft.com/en-us/azure/data-explorer/kusto/functions-library/series-rate-fl?tabs=adhoc

CliveWatson

Former Employee

Sep 12, 2019

Peter Hall

How about?

Event
| where TimeGenerated > ago(1h)
| summarize count() by bin(TimeGenerated, 1m)
| sort by TimeGenerated asc 
| extend accumulated =row_cumsum(count_)

Go to Log Analytics and Run Query

TimeGenerated	count_	accumulated
2019-09-12T14:46:00Z	343	343
2019-09-12T14:47:00Z	57	400
2019-09-12T14:48:00Z	49	449
2019-09-12T14:49:00Z	488	937
2019-09-12T14:50:00Z	321	1258
2019-09-12T14:51:00Z	354	1612
2019-09-12T14:52:00Z	378	1990
2019-09-12T14:53:00Z	482	2472
2019-09-12T14:54:00Z	344	2816
2019-09-12T14:55:00Z	501	3317

Peter Hall
Brass Contributor
Sep 12, 2019
CliveWatson you are a scholar and a gent. That would appear to do the trick. I'll adapt as necessary but thank you

Forum Discussion

Calculating rate of change in Log Analytics

Resources