OMSQry-functions.ps1

// LogAnalytics function to query a performance counter (CounterName), in computer, starting on date Sart for a 30d period
// Copy paste the query in LogAnalytics window

// Define custom Loganalytics function
let PerfCountWithin30dRange = (start:date, CounterName:string, CompName:string) {
let period = 30d;

Perf 
| where (TimeGenerated > start and TimeGenerated < start + period)
| where (Computer contains CompName)
| where CounterName == "User Count"
| summarize percentiles(CounterValue, 95)  by bin(TimeGenerated, 15m)
| render timechart
};


// VARIABLES
let start = ago(60d);
let comp = 'SERVERNAME';
let perfcountername = "User Count";

// Call the functions
PerfCountWithin30dRange(start, perfcountername, comp);