title: Azure OPDG System Aggregation Logs to TimeChart in KQL
body: <p>I am ingesting Azure OPDG System Aggregation logs from an Azure Monitoring Agent to an Azure Log Analytics Workspace. Each log is collected by timestamp and I am using Custom filters to separate out the <code>CounterMin</code>, <code>CounterMax</code>, <code>CounterAverage</code> and <code>CounterName</code>. The 4 types of <code>CounterName</code> are <code>GatewayCPUPercent</code>, <code>SystemCPUPercent</code>, <code>SystemMEMUsedPercent</code> and <code>GatewayMEMKb</code>. Unfortunately that last value, <code>GatewayMEMKb</code>, is not in a percentage of the Systems Total Memory, so tracking these 4 values on a timechart doesn't work.</p>
  <p>I'd like to convert the <code>GatewayMEMKb</code> to a <code>GatewayMEMUsedPercent</code>, and I have the value of the total memory of the server so should be able to do this, but I can't find out how to extract just those values of the <code>CounterAverage</code> column depending on the content of the <code>CounterName</code> column.</p>
  <p>I realise this may need to be achieved using a separate column, but can't figure out how to do it.</p>
  <p>Initial data:</p>
  <div class="s-table-container">
  <table class="s-table">
  <thead>
  <tr>
  <th>CounterName</th>
  <th>CounterAverage</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>GatewayCPUPercent</td>
  <td>15</td>
  </tr>
  <tr>
  <td>SystemCPUPercent</td>
  <td>45</td>
  </tr>
  <tr>
  <td>SystemMEMUsedPercent</td>
  <td>30</td>
  </tr>
  <tr>
  <td>GatewayMEMKb</td>
  <td>327,678</td>
  </tr>
  <tr>
  <td>GatewayCPUPercent</td>
  <td>14</td>
  </tr>
  <tr>
  <td>SystemCPUPercent</td>
  <td>48</td>
  </tr>
  <tr>
  <td>SystemMEMUsedPercent</td>
  <td>31</td>
  </tr>
  <tr>
  <td>GatewayMEMKb</td>
  <td>356,876</td>
  </tr>
  </tbody>
  </table>
  </div>
  <p>Desired outcome:</p>
  <div class="s-table-container">
  <table class="s-table">
  <thead>
  <tr>
  <th>CounterName</th>
  <th>CounterAverage</th>
  <th>GatewayMEMUsedPercent</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>GatewayCPUPercent</td>
  <td>15</td>
  <td></td>
  </tr>
  <tr>
  <td>SystemCPUPercent</td>
  <td>45</td>
  <td></td>
  </tr>
  <tr>
  <td>SystemMEMUsedPercent</td>
  <td>30</td>
  <td></td>
  </tr>
  <tr>
  <td>GatewayMEMKb</td>
  <td>327,678</td>
  <td>2.5</td>
  </tr>
  <tr>
  <td>GatewayCPUPercent</td>
  <td>14</td>
  <td></td>
  </tr>
  <tr>
  <td>SystemCPUPercent</td>
  <td>48</td>
  <td></td>
  </tr>
  <tr>
  <td>SystemMEMUsedPercent</td>
  <td>31</td>
  <td></td>
  </tr>
  <tr>
  <td>GatewayMEMKb</td>
  <td>356,876</td>
  <td>2.8</td>
  </tr>
  </tbody>
  </table>
  </div>