Forum Discussion
repeated alerts
Hi,
I tried to run this query provided by you, but getting the error as ;
'take' operator: Failed to resolve table or column expression named 'AlertHistory' Support id: 6b982987-9b2b-4b24-b555-9b6ee8787e87
Query :
Perf
| where TimeGenerated > ago(5m)
| where ObjectName == "Processor" and CounterName == "% Processor Time"
| summarize AggregatedValue = avg(CounterValue) by bin(TimeGenerated, 1m), Computer
| join (
AlertHistory
| limit 10
) on $left.Computer == $right.SourceDisplayName
What could be wrong on this query.
Hi, just change AlertHistory to Alert - it will only show if you have some?
Alert | where TimeGenerated > ago(30d) | summarize by Computer, AlertName
Go to Log Analytics and Run Query
Hi CLive,
this query output is always blank. Where we need to specify the threshold as 80% on this query?
Perf
| where TimeGenerated > ago(5m)
| where ObjectName == "Processor" and CounterName == "% Processor Time"
| summarize AggregatedValue = avg(CounterValue) by bin(TimeGenerated, 1m), Computer
| join (
Alert
| limit 10
) on $left.Computer == $right.SourceDisplayName- Hi, I was just giving you (and others) some KQL suggestions, hence a basic query, this isn't a fully working solution - it will need extra logic, and I don't even know if it will work...