Forum Discussion

johnnndoe's avatar
johnnndoe
Copper Contributor
Sep 08, 2023

Crossing data in the tables alertsmanagementresources and resource

Hello,

I am trying to cross these two tables trying to create a column where I can see the number of warnings alerts (Sev2) and that are fired (Fired) in the last 24 hours for each resource. I am joining them by the ID of the resource, but I can't get it to show it. Could you help me?


This is the query that I have in my workbook right now:

resources
| where type == "microsoft.compute/virtualmachines"
| extend extensionType = properties.type, 
    PowerStatus = properties.extended.instanceView.powerState.displayStatus,
    OSType = properties.storageProfile.osDisk.osType
| join kind=inner (
    resources
    | where type in~ ('microsoft.insights/metricalerts','microsoft.insights/scheduledqueryrules') and ['kind'] !in~ ('LogToMetric','LogToApplicationInsights')
    | extend severity = strcat("Sev", properties["severity"])
    | extend enabled = tobool(properties["enabled"])
    | where enabled in~ ('true')
    | extend ResourcePath = tostring(properties["scopes"][0])
    | extend ResourceName = split(ResourcePath, '/')[8]
    | summarize TotalAlerts = count() by tostring(ResourceName)
    ) on $left.name == $right.ResourceName
| join kind=leftouter (
    alertsmanagementresources
    | where properties.essentials.startDateTime > ago(24h)
    | where tostring(properties.essentials.severity) == "Sev0" and tostring(properties.essentials.monitorCondition) == "Fired"
    | extend id = tostring(properties.essentials.targetResource)
    | summarize Warning = count() by id
    ) on id
| project ComputerName=name, PowerStatus, OSType, ['id'], TotalAlerts, Warning


Thank you very much
Best regards

 

 

1 Reply

  • Clive_Watson's avatar
    Clive_Watson
    Bronze Contributor
    I dont have this data to check, but have you made sure that both ID's are the same (same case and same format), maybe you need to parse one first.

    e.g. if one is

    /subscriptions/<guid>/resourceGroups/adds-rg/providers/Microsoft.Compute/virtualMachines/computer01

    and the other is this, then they wont match in the Join

    Computer01