Query Azure Resource Graph from Azure Monitor

Copper Contributor

May 21, 2024

Oke check, thank you. For know I figured out another way by creating dynamic variables that I use later in the query.

For example, first finding the tag I need and then create a new query that uses that variable

let TagValueToSearch = toscalar(
    arg("").Resources
    | where type == "microsoft.desktopvirtualization/hostpools"
    | where name == HostPoolName
    | extend TagsParsed = parse_json(tags)
    | extend  DeploymentColor = tostring(TagsParsed.deploymentcolor)
    | project DeploymentColor
);

    arg("").desktopvirtualizationresources
    | extend HostPool = tostring(split(name, "/")[0])
    | where type == "microsoft.desktopvirtualization/hostpools/sessionhosts"
    | where HostPool == HostPoolName
    | extend VmResourceId = tolower(properties.resourceId), LastHeartBeat = properties.lastHeartBeat, HostPoolName
    | join kind=fullouter (
        VMComputer
        | extend VmResourceId = tolower(_ResourceId)
        | lookup (
        arg("").Resources
        | where type == 'microsoft.compute/virtualmachines'
        | where tostring(tags.deploymentcolor) == TagValueToSearch
        | project _ResourceId=tolower(id), vmTags=tags
        )
        on _ResourceId
    ) on VmResourceId

.
Using multiple ARG queries is possible as long you join an LA table as well

Blog Post

Query Azure Resource Graph from Azure Monitor