7

I'm fairly new to the Kusto Query language so perhaps this is something very common, but I really can't find my answer. So here goes.

I've enabled performance gathering with Azure Log Analytics on some of our servers and would like to achieve the following:

From the Perf dataset, select all the CPU data from the previous day and display the average CPU utilization per 5 minutes. Now I've figured out the first part, which was really easy to do. However I can't figure out how to do the per 5 minute selection in Kusto. I'm guessing something with summarise? Can anyone share some insights?

Perf
| where Computer == "servername.domain.internal"
| where TimeGenerated > ago(1d) 
| where CounterName == "% Processor Time" 
| where ObjectName == "Processor Information"
Michael Waterman
  • 125
  • 1
  • 7

1 Answers1

9

Try adding | summarize avg(CounterValue) by bin(Time Generated, 5m) to your query.

For charting, you can also append a | render timechart to the latter.

Yoni L.
  • 22,627
  • 2
  • 29
  • 48