Search code examples
kqlazure-monitoringazure-alerts

Unable to create valid KQL query for Azure Custom log search as Metric alert type

This is my KQL query

Perf
| where TimeGenerated > ago(60m)
| where (ObjectName == "Processor")
| summarize AggregatedValue = avg(CounterValue) by Computer , _ResourceId
| where AggregatedValue < 100
| project Computer, AggregatedValue

Error : Search Query should contain 'AggregatedValue' and 'bin(TimeGenerated, [roundTo])' for Metric alert type

Note : Above query is working successfully (prints result) in Azure Monitor - Logs as below image1. But same query is throwing Error while running in as below image2.

image1

------------------------------------------------------------------------------------------------- enter image description here

Solution

  • The error message seems very descriptive. Tried adding bin(TimeGenerated, [roundTo])

    It worked

        Perf
    | where TimeGenerated > ago(1h)
    | where CounterName == "% Processor Time" and InstanceName == "_Total" 
    | project TimeGenerated, Computer, CounterValue, _ResourceId
    | summarize AggregatedValue = avg(CounterValue)  by bin(TimeGenerated, 1h), Computer, _ResourceId

    Thanks @David דודו Markovitz