In the previous CPU Summarize examples you may have noticed there are only 2 or 3 fields returned. Summarize works like ProjectĪside from Summarizing data, the operator works almost exactly like the Project operator, which I talked about here. However, if you binned by 15 minutes on data that came in every 5, that would give you much better results. For instance binning by 5m on data that comes in every 15 minutes is not going to produce very good results. It all depends on how often you have data coming in. You can bin by whatever time metric you want, 12h (twelve hours), 5m (five minutes). An hourly bin in those instances will take a long time to produce your results.įor instance expanding the time range to 2 days but adding bin(TimeGenerated, 1d) produces 18 records, instead of 149 that the 24 hour, hourly binned query produced. That said, when summarizing data from days, weeks or months, an hourly bin is probably too aggressive and expensive.

Will produce the same result as if we added bin(TimeGenerated, 1h) | summarize avg(CounterValue) by Computer, TimeGenerated So the results should include roughly 24 hourly bins for each computer in the environment. Using the same example as above, simply add a TimeGenerated field to it, and it produces and hourly bin for the Time range that is specified next to run, in this instance its 24 hours. One of the first things to understand when using the Summarize operator is that Log Analytics can A) create a bin of your data by TimeGenerated and B) that if you don’t specify a bin time, it does it for you using hourly binning. For instance dcount() would be dcount_CounterValue. Whenever you use the Summarize Operator the result will produce a new field name with the aggregator in front. Notice that in the results pane instead of the CounterValue field there is a new field avg_CounterValue. | summarize avg(CounterValue) by Computer To summarize the average CPU usage use the avg() aggregator You can find all the currently available aggregation functions here Some of my favorites are avg(), dcount(), min(), max(), sum(). For example these two queries return the same results.īoth return the exact same 41 records under Perf for my environment.įor summarize to really be useful, we need to use an aggregation with it. It essentially works like the distinct operator. The Summarize operator isn’t very useful on its own. This post, however will be all about different ways you can use Summarize. Those posts I used in the summarize operator in real world examples. I’ve already used the summarize operator in posts here and here. It seems like at least once a week I learn something knew that it can do. The Summarize Operator will likely be the most commonly used Operator. I’ll be discussing how you can use the Azure Log Analytics Summarize operator when you query data in your Log Analytics workspace. This post is aimed at beginners with Azure Log Analytics.

Kusto summarize