Less Than 2000 Time Slices Error in OMS Log Analytics – Resolution


I’ve seen a lot of people having the following error appear when they do measurement functions in OMS Log Analytics Search:

Intervals for aggregate functions must result in less than 2000 time slices Unexpected ‘measure’ at position XX.

image

The reason for this error is that we are running measurement query for the past 1 day but we are slicing the intervals into 30 seconds results which results in more than 2000 time slices (results per computer).

The solution for this is simple like increasing the 30 seconds interval in the query or decreasing the time interval of the data:

60 Seconds interval (Option A)

Type=Perf ObjectName=Processor CounterName=”% Processor Time” InstanceName=_Total | measure avg(CounterValue) by Computer Interval 60seconds

image

6 Hours time frame (Option B)

Type=Perf ObjectName=Processor CounterName=”% Processor Time” InstanceName=_Total | measure avg(CounterValue) by Computer Interval 30seconds

image

As you can see both options work although they are not very pretty. That is why there is option C and I think it might be the best option for most of folks out there using OMS Log Analytics.

Option is to get rid of interval at all and use display instead. That way the query is dynamic and it fits in every time frame:

Type=Perf ObjectName=Processor CounterName=”% Processor Time” InstanceName=_Total | measure avg(CounterValue) by Computer | display LineChart

6 hours time frame

image

7 days time frame

image

30 days time frame

image

Of course if you need more granular slicer you always can go in advanced mode and use the interval.

I must say that previously this error hasn’t appeared but some changes on the platform in the last month cause more people to see it so I had to address it with proper answer.

I hope this will help in less questions about this error.

Advertisements

One thought on “Less Than 2000 Time Slices Error in OMS Log Analytics – Resolution

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s