Oct 05 2020
06:37 AM
- last edited on
Apr 08 2022
10:38 AM
by
TechCommunityAP
Oct 05 2020
06:37 AM
- last edited on
Apr 08 2022
10:38 AM
by
TechCommunityAP
I'm having issues designing a query in Log Analytics. My goal is to get the computer's CPU rank out of 100 by comparing it to other LogAnalytics computers.
let CPUavgOfMyComputer = Perf
| where Computer contains "myComputerName"
| where ObjectName == 'Processor' and CounterName == '% Processor Time' and InstanceName == '_Total'
| summarize avg(CounterValue);
Perf
| where ObjectName == 'Processor' and CounterName == '% Processor Time' and InstanceName == '_Total'
| summarize tdigestRes = tdigest(CounterValue), count()
| project rank_tdigest(tdigestRes, CPUavgOfMyComputer) * 100.0 / count_
I'm pretty sure my issue comes from my syntax on the rank_tdigest function (TDigest, Expr).
Can we use a variable for Expr ?
Oct 05 2020 10:46 AM
Solution
It was asking for a scalar expression, like this:
let CPUavgOfMyComputer = toscalar(Perf
| where Computer has "name here"
| where ObjectName == 'Processor' and CounterName == '% Processor Time' and InstanceName == '_Total'
| summarize avg(CounterValue));
Perf
| where ObjectName == 'Processor' and CounterName == '% Processor Time' and InstanceName == '_Total'
| summarize tdigestRes = tdigest(CounterValue), count()
| project rank_tdigest(tdigestRes, CPUavgOfMyComputer) * 100.0 / count_