Query for Disk Space utilization

[Lucas Chies]

Hello all.

I'm trying to get the disk space information for some VMs, but I want to inform the VM Name that I need the information. Actually I'm using the below script, but if, I inform more than one VM, the script don't show the informations.

let start_time=startofday(datetime("2020-05-06"));

let end_time=endofday(datetime("2020-05-06"));

Perf

| where TimeGenerated > start_time and TimeGenerated < end_time

| where ObjectName == "LogicalDisk" and CounterName == "% Free Space"

| where InstanceName contains "D:"

| where Computer contains "VM72" and Computer contains "VM073" and

Computer contains "VM74"

Please, someone can help me on this?

[#2]

@Lucas Chies 

IN or Has_any could be used, best practise is to prefer HAS over CONTAINS.  However this may be an issue if you really are looking for substrings like VM073 (which is part of a name) - can you use the full name?

let start_time=startofday(datetime("2020-05-06"));
let end_time=endofday(datetime("2020-05-06"));
Perf
| where TimeGenerated > start_time and TimeGenerated < end_time
| where Computer in ("demo1","demo2","RETAILVM01")
| where ObjectName == "LogicalDisk" and CounterName == "% Free Space"
| where InstanceName has "D:"

[#3]

@Lucas Chies 

To answer the original question, you could use OR rather than AND, or use regex, like this?

let start_time=startofday(datetime("2020-05-06"));
let end_time=endofday(datetime("2020-05-06"));
Perf
| where TimeGenerated > start_time and TimeGenerated < end_time
| where Computer matches regex '(?i)[a-z]VM0+' or Computer matches regex '(?i)[a-z]VM+'
| where ObjectName == "LogicalDisk" and CounterName == "% Free Space"
| where InstanceName has "D:"

and simply using OR - see line 5 

let start_time=startofday(datetime("2020-05-06"));
let end_time=endofday(datetime("2020-05-06"));
Perf
| where TimeGenerated > start_time and TimeGenerated < end_time
| where Computer contains "retail" or Computer contains "demo" 
| where ObjectName == "LogicalDisk" and CounterName == "% Free Space"
| where InstanceName has "D:"