Forum Discussion

Brass Contributor

Mar 11, 2020

Solved

VM details query

Hi Team, Trying to query VM details using KQL but unable to include different thing in query. VMComputer | where _ResourceId != "" | summarize by TimeGenerated, HostName, AzureImageSku, Az...

Mar 11, 2020

Those data types are arrays, so need to be strings at the end of a Summarize - I used tostring to allow this

Go to Log Analytics and run query

VMComputer
| where _ResourceId != ""
| summarize by TimeGenerated, HostName, AzureImageSku, AzureResourceGroup,
               AzureLocation, AzureSize, Cpus, DependencyAgentVersion, 
               PhysicalMemoryMB, OperatingSystemFamily, OperatingSystemFullName, 
               VirtualMachineType, VirtualizationState,
               tostring(Ipv4Addresses), tostring(Ipv4DefaultGateways), tostring(Ipv4SubnetMasks), tostring(MacAddresses)

CliveWatson

Former Employee

Mar 17, 2020

Rahul_Mahajan

For a single line output you can try, a query like this

Go to Log Analytics and run query

harisankaran

Copper Contributor

Aug 24, 2023

I want to find out when the vm was deallcated using kql, can you help me.

Clive_Watson

Bronze Contributor

Aug 25, 2023

harisankaran

Powerstate is exposed in ARG (so you can use KQL). I think time Created is also timeUpdated but you'd have to confirm.

resources
| where type == "microsoft.compute/virtualmachines"
| extend extensionType = properties.type, 
	status = properties.provisioningState,
	timeCreated = properties.timeCreated,
	version = properties.typeHandlerVersion,
    PowerStatus = properties.extended.instanceView.powerState.displayStatus,
	OSType = properties.storageProfile.osDisk.osType
| project ComputerName=name, PowerStatus,timeCreated, status, version, OSType, ['id'], properties