Forum Discussion
johnnndoe
Sep 08, 2023Copper Contributor
Crossing data in the tables alertsmanagementresources and resource
Hello,
I am trying to cross these two tables trying to create a column where I can see the number of warnings alerts (Sev2) and that are fired (Fired) in the last 24 hours for each resource. I am joining them by the ID of the resource, but I can't get it to show it. Could you help me?
This is the query that I have in my workbook right now:
resources
| where type == "microsoft.compute/virtualmachines"
| extend extensionType = properties.type,
PowerStatus = properties.extended.instanceView.powerState.displayStatus,
OSType = properties.storageProfile.osDisk.osType
| join kind=inner (
resources
| where type in~ ('microsoft.insights/metricalerts','microsoft.insights/scheduledqueryrules') and ['kind'] !in~ ('LogToMetric','LogToApplicationInsights')
| extend severity = strcat("Sev", properties["severity"])
| extend enabled = tobool(properties["enabled"])
| where enabled in~ ('true')
| extend ResourcePath = tostring(properties["scopes"][0])
| extend ResourceName = split(ResourcePath, '/')[8]
| summarize TotalAlerts = count() by tostring(ResourceName)
) on $left.name == $right.ResourceName
| join kind=leftouter (
alertsmanagementresources
| where properties.essentials.startDateTime > ago(24h)
| where tostring(properties.essentials.severity) == "Sev0" and tostring(properties.essentials.monitorCondition) == "Fired"
| extend id = tostring(properties.essentials.targetResource)
| summarize Warning = count() by id
) on id
| project ComputerName=name, PowerStatus, OSType, ['id'], TotalAlerts, Warning
Thank you very much
Best regards
1 Reply
- Clive_WatsonBronze ContributorI dont have this data to check, but have you made sure that both ID's are the same (same case and same format), maybe you need to parse one first.
e.g. if one is
/subscriptions/<guid>/resourceGroups/adds-rg/providers/Microsoft.Compute/virtualMachines/computer01
and the other is this, then they wont match in the Join
Computer01