Forum Discussion
Need help with Azure log queries
Swapna Nethi
The query is aligned to KQL best practices, please note that the size of your query is due to the complexity.https://docs.microsoft.com/en-us/azure/data-explorer/kusto/query/best-practices
But, I think there are two good options available.
1. Use materialize() function:
https://docs.microsoft.com/en-us/azure/data-explorer/kusto/query/materializefunction
2. Create your own functions:
https://docs.microsoft.com/en-us/azure/azure-monitor/log-query/functions
Both have similar goals but I can personally recommend the log query functions (option 2) since I have used it. With functions, you can keep your queries behind the scenes so when you are typing it, you can reduce complex queries to very few lines.
Besides that, since you are using various unions there, I think your query is good in terms of optimization or logic. You might want to use functions to reduce the query size though.
MicrosoftSwapna Nethi
Hi Swapna, could you please tell us what is your goal? Is the query you provided currently working? Is it facing performance issues?
jpmartinez , There is no issue with query above but my goal is accomplish the job i am doing using above query in a more optimized way to avoid the repetitive portions of the code.
My Goal is to write a query to check the disk space of windows computers connected to multiple log analytics workspaces. The important point is the threshold /free space to be checked is different for few set of computers whereas it is usually 10% for most of them.
I managed to write the query as in my code snippet but i myself felt there is lot of repetitive code /commands i am using. I want to know if there is any other way like using OR or switch commands this can be achieved .