Azure monitoring Kusto query

%3CLINGO-SUB%20id%3D%22lingo-sub-1454748%22%20slang%3D%22en-US%22%3EAzure%20monitoring%20Kusto%20query%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1454748%22%20slang%3D%22en-US%22%3E%3CP%3EPerf%3CBR%20%2F%3E%7C%20where%20ObjectName%20%3D%3D%20%22LogicalDisk%22%20and%20CounterName%20%3D%3D%20%22%25%20Free%20Space%22%20and%20Computer%20!%3D%20%22net-fs3.networkhg.org.uk%22%20and%20Computer%20!%3D%20%22NET-FS1.networkhg.org.uk%22%20and%20Computer%20!%3D%20%22NET-SQL3.networkhg.org.uk%22%20and%20Computer%20!%3D%20%22NET-EDMLIVEDB1.networkhg.org.uk%22%20and%20Computer%20!%3D%20%22NET-EDM_KOFAX1.networkhg.org.uk%22%3CBR%20%2F%3E%7C%20summarize%20Free_Space%20%3D%20min(CounterValue)%20by%20Computer%2C%20InstanceName%3CBR%20%2F%3E%7C%20where%20strlen(InstanceName)%20%3D%3D%202%20and%20InstanceName%20contains%20%22%3A%22%20and%20Computer%20!%3D%20%22NET-REPAIR2.networkhg.org.uk%22%20and%20InstanceName%20!contains%20%22%3AE%22%20and%20Computer%20!%3D%20%22NH-E2016-01.networkhg.org.uk%22%20and%20InstanceName%20!contains%20%22%3AE%22%20and%20Computer%20!%3D%20%22NH-E2016-02.networkhg.org.uk%22%20and%20InstanceName%20!contains%20%22%3AE%22%3C%2FP%3E%3CP%3E%7C%26nbsp%3B%3CFONT%3Ewhere%20Free_Space%20%26lt%3B%2015%20and%20Free_Space%20%26gt%3B%2010%3C%2FFONT%3E%3CBR%20%2F%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%26nbsp%3B%20need%20assistance%20with%20the%20query%20above%2C%26nbsp%3B%3CSPAN%3Ea%3CSTRONG%3End%20Computer%20!%3D%20%22NH-E2016-01.networkhg.org.uk%22%20and%20InstanceName%20!contains%20%22%3AE%22%20-%20the%20query%20doesn't%20output%20any%20drive%20for%20that%20NH-E2016%20%2C%20even%20there%20is%20one%20drive%20with%2011%25%2C%20c%20drive%2C%20it%20completely%20avoids%20the%20server.%3C%2FSTRONG%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3EHow%20can%20I%20amend%20this%20query%20where%20I%20wanted%20that%20server%20to%20avoid%20E%20drive%20but%20monitor%20other%20drives%20with%20specified%20percentage.%20%26nbsp%3B%3C%2FSPAN%3E%3CFONT%3E%3CBR%20%2F%3E%3C%2FFONT%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1454748%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EMonitoring%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1455791%22%20slang%3D%22en-US%22%3ERe%3A%20Azure%20monitoring%20Kusto%20query%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1455791%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F643248%22%20target%3D%22_blank%22%3E%40Arslan11%3C%2FA%3E%26nbsp%3BYou%20put%26nbsp%3B%3CSTRONG%3EComputer%20!%3D%20%22NH-E2016-01.networkhg.org.uk%22%20%3C%2FSTRONG%3Ewhich%20would%20avoid%20this%20computer%20completely%20no%20matter%20what%20you%20put%20behind%20it%2C%20I%20think.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAlso%2C%20you%20can%20create%20a%20group%20in%20log%20analytics%20(go%20to%20saved%20searches%2C%20there%20you%20can%20create%20a%20search%20as%20a%20group).%20Eg%20this%20is%20one%20group%20I%20have%20for%20servers%20that%20I%20want%20Critical%20patches%20to%20run%20upon%20in%20another%20group%20called%20EuropeServers%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHeartbeat%3C%2FP%3E%3CDIV%3E%3CDIV%3E%3CSPAN%3E%7C%20%3C%2FSPAN%3E%3CSPAN%3Ewhere%3C%2FSPAN%3E%3CSPAN%3E%20Computer%20!in%20(EuropeNonCriticalPatch)%20%3C%2FSPAN%3E%3CSPAN%3Eand%3C%2FSPAN%3E%3CSPAN%3E%20Computer%20in%20(EuropeServers)%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3E%7C%20%3C%2FSPAN%3E%3CSPAN%3Edistinct%3C%2FSPAN%3E%3CSPAN%3EComputer%3C%2FSPAN%3E%3C%2FDIV%3E%3C%2FDIV%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAnd%20in%20the%20%3CSPAN%3EEuropeNonCriticalPatch%20I%20have%20things%20like%3A%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Esearch%20%22Heartbeat%22%3CBR%20%2F%3E%7C%20where%20(Computer%20%3D%3D%20%22computerA%22%20or%20Computer%20%3D%3D%20%22computerB%22%20or%20Computer%20%3D%3D%20%22computerC%22%20or%20Computer%20%3D%3D%20%22computerD%22)%3CBR%20%2F%3E%7C%20distinct%20Computer%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ESo%20you%20could%20create%20something%20similar%20in%20your%20case.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1455825%22%20slang%3D%22en-US%22%3ERe%3A%20Azure%20monitoring%20Kusto%20query%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1455825%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F671042%22%20target%3D%22_blank%22%3E%40-Akos-%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ESome%20other%20ideas%2C%20I%20prefer%20to%20reduce%20the%20amount%20of%20%22or%22's%20and%20replace%20with%20an%20%22in%22%20or%20%22!in%22%3C%2FP%3E%0A%3CPRE%20class%3D%22lia-code-sample%20language-csharp%22%3E%3CCODE%3Esearch%20%22Heartbeat%22%0A%7C%20where%20Computer%20in%20(%22computerA%22%2C%22computerB%22%2C%22computerC%22%20%2C%22computerD%22)%0A%7C%20distinct%20Computer%3C%2FCODE%3E%3C%2FPRE%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3Eor%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CPRE%20class%3D%22lia-code-sample%20language-csharp%22%3E%3CCODE%3Elet%20computerList%20%3D%20dynamic(%5B%22computerA%22%2C%22computerB%22%2C%22computerC%22%20%2C%22computerD%22%5D)%3B%0Asearch%20%22Heartbeat%22%0A%7C%20where%20Computer%20in%20(computerList)%0A%7C%20distinct%20Computer%0A%3C%2FCODE%3E%3C%2FPRE%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20data-unlink%3D%22true%22%3EFYI%2C%3CBR%20%2F%3EHome%26nbsp%3B-%20Azure%20-%26nbsp%3B%26nbsp%3B%3CSPAN%20class%3D%22lia-link-navigation%20crumb-board%20lia-breadcrumb-board%20lia-breadcrumb-forum%20lia-link-disabled%22%20title%3D%22current%20location%20is%20Azure%20Log%20Analytics%22%20aria-label%3D%22current%20location%20is%20Azure%20Log%20Analytics%22%3EAzure%20Log%20Analytics%26nbsp%3B%20(in%20another%20forum%20to%20use%20on%20this%20platform%20for%20KQL%20help)%3C%2FSPAN%3E%3CBR%20%2F%3E%3CBR%20%2F%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1456162%22%20slang%3D%22en-US%22%3ERe%3A%20Azure%20monitoring%20Kusto%20query%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1456162%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F239477%22%20target%3D%22_blank%22%3E%40Clive%20Watson%3C%2FA%3E%26nbsp%3B%20thanks%20my%20question%20towards%2C%20how%20can%20avoid%20one%20instance%20name%26nbsp%3B%20not%20be%20monitored%20on%20a%20server%20instead%20of%20avoiding%20all%20the%20instance%20name%20when%20using%20the%20language%20specified%20below%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSTRONG%3Eand%20Computer%20!%3D%20%22NH-E2016-01.networkhg.org.uk%22%20and%20InstanceName%20!contains%20%22%3AE%22%3C%2FSTRONG%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E
Contributor

Perf
| where ObjectName == "LogicalDisk" and CounterName == "% Free Space" and Computer != "net-fs3.networkhg.org.uk" and Computer != "NET-FS1.networkhg.org.uk" and Computer != "NET-SQL3.networkhg.org.uk" and Computer != "NET-EDMLIVEDB1.networkhg.org.uk" and Computer != "NET-EDM_KOFAX1.networkhg.org.uk"
| summarize Free_Space = min(CounterValue) by Computer, InstanceName
| where strlen(InstanceName) == 2 and InstanceName contains ":" and Computer != "NET-REPAIR2.networkhg.org.uk" and InstanceName !contains ":E" and Computer != "NH-E2016-01.networkhg.org.uk" and InstanceName !contains ":E" and Computer != "NH-E2016-02.networkhg.org.uk" and InstanceName !contains ":E"

where Free_Space < 15 and Free_Space > 10

 

I  need assistance with the query above, and Computer != "NH-E2016-01.networkhg.org.uk" and InstanceName !contains ":E" - the query doesn't output any drive for that NH-E2016 , even there is one drive with 11%, c drive, it completely avoids the server.

 

How can I amend this query where I wanted that server to avoid E drive but monitor other drives with specified percentage.  

3 Replies

@Arslan11 You put Computer != "NH-E2016-01.networkhg.org.uk" which would avoid this computer completely no matter what you put behind it, I think.

 

Also, you can create a group in log analytics (go to saved searches, there you can create a search as a group). Eg this is one group I have for servers that I want Critical patches to run upon in another group called EuropeServers:

 

Heartbeat

| where Computer !in (EuropeNonCriticalPatch) and Computer in (EuropeServers)
| distinct Computer

 

And in the EuropeNonCriticalPatch I have things like:

 

search "Heartbeat"
| where (Computer == "computerA" or Computer == "computerB" or Computer == "computerC" or Computer == "computerD")
| distinct Computer

 

So you could create something similar in your case.

@-Akos- 

 

Some other ideas, I prefer to reduce the amount of "or"'s and replace with an "in" or "!in"

search "Heartbeat"
| where Computer in ("computerA","computerB","computerC" ,"computerD")
| distinct Computer

 

or

 

let computerList = dynamic(["computerA","computerB","computerC" ,"computerD"]);
search "Heartbeat"
| where Computer in (computerList)
| distinct Computer

 

FYI,
Home - Azure -  Azure Log Analytics  (in another forum to use on this platform for KQL help)

 

@Clive Watson  thanks my question towards, how can avoid one instance name  not be monitored on a server instead of avoiding all the instance name when using the language specified below

 

and Computer != "NH-E2016-01.networkhg.org.uk" and InstanceName !contains ":E"