May 07 2020
08:31 AM
- last edited on
Apr 08 2022
10:26 AM
by
TechCommunityAP
May 07 2020
08:31 AM
- last edited on
Apr 08 2022
10:26 AM
by
TechCommunityAP
Hello all.
I'm trying to get the disk space information for some VMs, but I want to inform the VM Name that I need the information. Actually I'm using the below script, but if, I inform more than one VM, the script don't show the informations.
May 08 2020 04:21 AM
IN or Has_any could be used, best practise is to prefer HAS over CONTAINS. However this may be an issue if you really are looking for substrings like VM073 (which is part of a name) - can you use the full name?
let start_time=startofday(datetime("2020-05-06"));
let end_time=endofday(datetime("2020-05-06"));
Perf
| where TimeGenerated > start_time and TimeGenerated < end_time
| where Computer in ("demo1","demo2","RETAILVM01")
| where ObjectName == "LogicalDisk" and CounterName == "% Free Space"
| where InstanceName has "D:"
May 08 2020 04:30 AM
To answer the original question, you could use OR rather than AND, or use regex, like this?
let start_time=startofday(datetime("2020-05-06"));
let end_time=endofday(datetime("2020-05-06"));
Perf
| where TimeGenerated > start_time and TimeGenerated < end_time
| where Computer matches regex '(?i)[a-z]VM0+' or Computer matches regex '(?i)[a-z]VM+'
| where ObjectName == "LogicalDisk" and CounterName == "% Free Space"
| where InstanceName has "D:"
and simply using OR - see line 5
let start_time=startofday(datetime("2020-05-06"));
let end_time=endofday(datetime("2020-05-06"));
Perf
| where TimeGenerated > start_time and TimeGenerated < end_time
| where Computer contains "retail" or Computer contains "demo"
| where ObjectName == "LogicalDisk" and CounterName == "% Free Space"
| where InstanceName has "D:"