Azure Virtual Machine runtime calculation

Hello All, I currently have an azure automation runbook that executes a get-azurermvm command against all the subscriptions in our tenant. This script compiles a table, that lists the vmSize and St...

azure monitor

Query Language

Noa Kuperberg

Microsoft

May 14, 2018

Hi John,

The exact query depends on your specific table structure, which I don't have (I see you provided the field names but I need access to the actual table to create a working example).

I've created an example query based on the Heartbeat table, you can adjust it to meet your custom logs:

Heartbeat
| where TimeGenerated > ago(7d)
| summarize heartbeats_per_hour=count() by bin(TimeGenerated, 1h), Computer
| extend state_per_hour=iff(heartbeats_per_hour>0, true, false)
| summarize total_running_hours=countif(state_per_hour==true) by Computer
| where total_running_hours > 8

you can also run it on our demo environment.

basically, this query finds computers that have been running for more than 8 hours (total) over the last 7 days. I am not sure why 40 hours would be more complicated, can you explain what you meant?

HTH,

Noa