how to interpret azure charts

Question

I am wondering if someone can help me in interpreting the azure stats

query

Perf
| where CounterName == "% Processor Time"
| where ObjectName == "Processor"
| summarize avg(CounterValue) by bin(TimeGenerated, 15min), Computer, _ResourceId // bin is used to set the time grain to 15 minutes
| render timechart

output

I am not able to understand avg_counterValue? In documentation - counterValue is defined as Numeric value of the counter and I am not able to relate this counter with processor. Can someone help.

Answer 1

To interpret such kusto queries, I would recommend to first check the respective table's or data type's reference. In this case as the table is "Perf" so check this table reference. The reference explains that the CounterValue column's type is 'Real' which means it represents an approximation of a real number. Next, I would recommend to check the output of the basic query without much filtering i.e., something like shown below.

Perf
| where CounterName == "% Processor Time"
| where ObjectName == "Processor"

Next, if the number of records are huge and if you want to summarize them by aggregating the content of the table based on particular columns of the table then you can do it by leveraging summarize operator.

In your case, you have aggregated based on columns like Computer, _ResourceId and summarized over a time grain range of 15mins.

Illustration with output from my environment:

Perf
| where CounterName == "% Processor Time"
| where ObjectName == "Processor"
| summarize avg(CounterValue) by bin(TimeGenerated, 15min), Computer, _ResourceId // bin is used to set the time grain to 15 minutes
| render timechart

In the above example, the average CounterValue at 6:15AM is 0.712 that means the average of all the values of CounterValue column from 6:00AM to 6:15AM is 0.712.