ava_mem_log_analytics

// Chart memory if its under nnMB over the past nn days/hours
let setMBValue = 1024;
// enter a MB value to check
let startDate = ago(5h);
// enter how many days/hours to look back on
Perf
| where TimeGenerated > startDate
| where ObjectName == "Memory" and CounterName == "Available Mbytes" and Computer in ((Heartbeat
| where OSType == "Windows"
| distinct Computer))
| extend FreeMemory = CounterValue
| summarize FreeMemoryMB = min(FreeMemory) by Computer
| where FreeMemoryMB < setMBValue
| summarize max(FreeMemoryMB) by Computer
| join
(
Perf
| where TimeGenerated > startDate
| where ObjectName == "Memory" and CounterName == "Available Mbytes" and Computer in ((Heartbeat
| where OSType == "Windows"
| distinct Computer))
| extend FreeMemory = CounterValue
)
on Computer
| make-series Free_Memory_MB = min(FreeMemory) on TimeGenerated from ago(1d) to now() step 2h by Computer
| render timechart