Skip to content

Commit fa5ae18

Browse files
awslesawsles
committed
Create Kusto Graph Explorer Queries.md
1 parent 5da22f4 commit fa5ae18

File tree

1 file changed

+314
-0
lines changed

1 file changed

+314
-0
lines changed

‎AZURE/Kusto Graph Explorer Queries.md

Lines changed: 314 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,314 @@
1+
# Kusto Graph Explorer Queries
2+
3+
4+
### LIST ALL SUBSCRIPTIONS ###
5+
```
6+
ResourceContainers
7+
| where type =~ 'microsoft.resources/subscriptions'
8+
| project SubName=name, subscriptionId
9+
```
10+
11+
### LIST ALL VMs (simple) ###
12+
```
13+
Resources
14+
| where type =~ 'Microsoft.Compute/virtualMachines'
15+
| project subscriptionId, name, resourceGroup, location, properties.hardwareProfile.vmSize,
16+
properties.storageProfile.osDisk.osType, properties.host.id, tags
17+
| limit 25
18+
```
19+
20+
21+
### LIST ALL VMs (joined with subscription name) ###
22+
```
23+
Resources
24+
| where type =~ 'Microsoft.Compute/virtualMachines'
25+
| join kind=leftouter (ResourceContainers | where type=~'microsoft.resources/subscriptions'
26+
| project SubName=name, subscriptionId) on subscriptionId
27+
| project subscriptionId, name, resourceGroup, location,
28+
vmSize = tostring(properties.hardwareProfile.vmSize),
29+
osType = tostring(properties.storageProfile.osDisk.osType),
30+
hostId = tostring(properties.host.id), tags, id
31+
```
32+
33+
34+
### LIST ALL VMs WHICH HAVE OMS EXTENSIONS (with workspace ID mapped to details) ###
35+
```
36+
Resources
37+
| where type =~ 'microsoft.compute/virtualmachines/extensions'
38+
and properties.publisher =~ 'Microsoft.EnterpriseCloud.Monitoring'
39+
| extend workspaceId = tostring(properties.settings.workspaceId)
40+
| extend vmName = tostring(split(id,'/',8)[0])
41+
| join kind=leftouter (Resources | where type=~ 'microsoft.operationalinsights/workspaces'
42+
| project workspaceId=tostring(properties.customerId),
43+
sku = tostring(properties.sku.name), tags, id,
44+
retentionInDays = tostring(properties.retentionInDays),
45+
dailyQuotaGb = tostring(properties.workspaceCapping.dailyQuotaGb)) on workspaceId
46+
| project subscriptionId, vmName, id, tags, sku, name, kind, plan, location, resourceGroup,
47+
managedBy, identity, tenantId, workspaceId, retentionInDays
48+
```
49+
50+
51+
### LIST ALL VMs WHICH HAVE OMS EXTENSIONS (with subscription name and named details) ###
52+
```
53+
Resources
54+
| where type =~ 'microsoft.compute/virtualmachines/extensions'
55+
and properties.publisher =~ 'Microsoft.EnterpriseCloud.Monitoring'
56+
| extend ExtensionName = tostring(name)
57+
| extend workspaceId = tostring(properties.settings.workspaceId)
58+
| extend vmName = tostring(split(id,'/',8)[0])
59+
| join kind=leftouter (ResourceContainers | where type=~'microsoft.resources/subscriptions'
60+
| project SubName=name, subscriptionId) on subscriptionId
61+
| join kind=leftouter (Resources | where type=~ 'microsoft.operationalinsights/workspaces'
62+
| project workspaceId=tostring(properties.customerId),
63+
sku1 = tostring(properties.sku.name), tags, id,
64+
retentionInDays = tostring(properties.retentionInDays),
65+
dailyQuotaGb = tostring(properties.workspaceCapping.dailyQuotaGb)) on workspaceId
66+
| project subscriptionId, SubName, vmName, resourceGroup, sku1, ExtensionName, kind, plan, location,
67+
managedBy, identity, tenantId, workspaceId, retentionInDays, tags, properties, id
68+
```
69+
70+
71+
### LIST ALL VMs AND THIER OMS EXTENSIONS (with subscription name and named details) ###
72+
```
73+
Resources
74+
| where type =~ 'microsoft.compute/virtualmachines/extensions'
75+
and properties.publisher =~ 'Microsoft.EnterpriseCloud.Monitoring'
76+
| extend ExtensionName = tostring(name)
77+
| extend workspaceId = tostring(properties.settings.workspaceId)
78+
| extend vmName = tostring(split(id,'/',8)[0])
79+
| join kind=leftouter (ResourceContainers | where type=~'microsoft.resources/subscriptions'
80+
| project SubName=name, subscriptionId) on subscriptionId
81+
| join kind=leftouter (Resources | where type=~ 'microsoft.operationalinsights/workspaces'
82+
| project workspaceId=tostring(properties.customerId),
83+
sku1 = tostring(properties.sku.name), tags, id,
84+
retentionInDays = tostring(properties.retentionInDays),
85+
dailyQuotaGb = tostring(properties.workspaceCapping.dailyQuotaGb)) on workspaceId
86+
| project subscriptionId, SubName, vmName, resourceGroup, sku1, ExtensionName, kind, plan, location,
87+
managedBy, identity, tenantId, workspaceId, retentionInDays, tags, properties, id
88+
```
89+
90+
91+
92+
ALTERNATE:
93+
```
94+
Resources
95+
| where type =~ 'Microsoft.Compute/virtualMachines'
96+
| project subscriptionId, name, resourceGroup, location,
97+
vmSize = tostring(properties.hardwareProfile.vmSize),
98+
osType = tostring(properties.storageProfile.osDisk.osType),
99+
hostId = tostring(properties.host.id), tags, id
100+
| join kind=leftouter (ResourceContainers | where type=~'microsoft.resources/subscriptions'
101+
| project SubName=name, subscriptionId) on subscriptionId
102+
| join kind=leftouter (Resources
103+
| where type =~ 'microsoft.compute/virtualmachines/extensions'
104+
and properties.publisher =~ 'Microsoft.EnterpriseCloud.Monitoring'
105+
| extend ExtensionName = tostring(name)
106+
| extend workspaceId = tostring(properties.settings.workspaceId)
107+
| extend id1 = tostring(split(tostring(id),'/extensions')[0])
108+
| extend vmName = tostring(split(id,'/',8)[0])
109+
| project-away id, tags, type, subscriptionId, name, resourceGroup, location) on $left.id == $right.id1
110+
| join kind=leftouter (Resources | where type=~ 'microsoft.operationalinsights/workspaces'
111+
| project workspaceId=tostring(properties.customerId),
112+
sku1 = tostring(properties.sku.name), tags, id,
113+
retentionInDays = tostring(properties.retentionInDays),
114+
dailyQuotaGb = tostring(properties.workspaceCapping.dailyQuotaGb)) on workspaceId
115+
116+
| project subscriptionId, SubName, vmName, resourceGroup, ExtensionName, sku1, kind, plan, location,
117+
managedBy, identity, tenantId, workspaceId, retentionInDays, dailyQuotaGb, tags, properties, id
118+
```
119+
120+
121+
### LIST ALL VIRTUAL MACHINES WITH EXTENSIONS
122+
This may not be working...
123+
```
124+
Resources
125+
| where type =~ 'microsoft.compute/virtualmachines/extensions'
126+
and properties.publisher =~ 'Microsoft.EnterpriseCloud.Monitoring'
127+
| extend ExtensionName = tostring(name)
128+
| extend workspaceId = tostring(properties.settings.workspaceId)
129+
| extend vmName = tostring(split(id,'/',8)[0])
130+
| extend vmId = tolower(tostring(split(tostring(id),'/extensions')[0]))
131+
| join kind=leftouter (ResourceContainers | where type=~'microsoft.resources/subscriptions'
132+
| project SubName=name, subscriptionId) on subscriptionId
133+
| join kind=leftouter (Resources | where type=~ 'microsoft.operationalinsights/workspaces'
134+
| project workspaceId=tostring(properties.customerId),
135+
sku1 = tostring(properties.sku.name), tags, id,
136+
retentionInDays = tostring(properties.retentionInDays),
137+
dailyQuotaGb = tostring(properties.workspaceCapping.dailyQuotaGb)) on workspaceId
138+
| project subscriptionId, SubName, vmName, resourceGroup, sku1, ExtensionName, kind, plan, location,
139+
managedBy, identity, tenantId, workspaceId, retentionInDays, tags, properties, id, vmId
140+
141+
| join kind=rightouter (Resources | where type =~ 'Microsoft.Compute/virtualMachines'
142+
| extend vmId = tolower(tostring(id))
143+
| project subscriptionId, name, resourceGroup, location,
144+
vmSize = tostring(properties.hardwareProfile.vmSize),
145+
osType = tostring(properties.storageProfile.osDisk.osType),
146+
hostId = tostring(properties.host.id), tags, vmId) on vmId
147+
148+
149+
150+
151+
| join kind=fullouter (Resources | where type =~ 'Microsoft.Compute/virtualMachines'
152+
| extend vmId = tolower(tostring(id))
153+
| project subscriptionId, name, resourceGroup, location,
154+
vmSize = tostring(properties.hardwareProfile.vmSize),
155+
osType = tostring(properties.storageProfile.osDisk.osType),
156+
hostId = tostring(properties.host.id), tags, id) on vmId
157+
```
158+
159+
160+
### LIST ALL VIRTUAL MACHINES WITH DETAIL 1
161+
```
162+
Resources
163+
| where type =~ 'Microsoft.Compute/virtualMachines'
164+
| project subscriptionId, name, resourceGroup, location, properties.hardwareProfile.vmSize,
165+
properties.storageProfile.osDisk.osType, properties.host.id, tags, id
166+
| join kind=leftouter (Resources
167+
| where type =~ 'microsoft.compute/virtualmachines/extensions'
168+
and properties.publisher =~ 'Microsoft.EnterpriseCloud.Monitoring'
169+
| extend ExtensionName = tostring(name)
170+
| extend workspaceId = tostring(properties.settings.workspaceId)
171+
| extend id1 = tostring(split(tostring(id),'/extensions'))
172+
| extend vmName = tostring(split(id,'/',8)[0])) on $left.id == $right.id1
173+
```
174+
175+
176+
### LIST ALL VIRTUAL MACHINES WITH DETAIL 2
177+
```
178+
Resources
179+
| where type =~ 'Microsoft.Compute/virtualMachines'
180+
| join kind=leftouter (ResourceContainers | where type=~'microsoft.resources/subscriptions'
181+
| project SubName=name, subscriptionId) on subscriptionId
182+
| project subscriptionId, name, resourceGroup, location, properties.hardwareProfile.vmSize,
183+
properties.storageProfile.osDisk.osType, properties.host.id, tags
184+
```
185+
186+
187+
### LIST RESOURCE COUNTS BY SUBSCRIPTION
188+
```
189+
Resources
190+
| summarize resourceCount=count() by subscriptionId
191+
| join kind=leftouter (ResourceContainers | where type=='microsoft.resources/subscriptions' | project SubName=name, subscriptionId) on subscriptionId
192+
| project-away subscriptionId, subscriptionId1
193+
```
194+
195+
### LIST ALL KEY VAULTS
196+
```
197+
Resources
198+
| where type == 'microsoft.keyvault/vaults'
199+
| join (ResourceContainers | where type=='microsoft.resources/subscriptions' | project SubName=name, subscriptionId) on subscriptionId
200+
| project type, name, SubName
201+
| limit 1
202+
```
203+
204+
### LIST ALL VIRTUAL MACHINES
205+
```
206+
Resources
207+
| where type =~ 'Microsoft.Compute/virtualMachines'
208+
| join (ResourceContainers | where type =~ 'microsoft.resources/subscriptions' | project SubName=name, subscriptionId) on subscriptionId
209+
| project type, name, SubName
210+
| limit 25
211+
```
212+
213+
---
214+
215+
216+
### LIST ALL DATA SERVICES ###
217+
218+
```
219+
Resources
220+
| where (type contains 'microsoft.azuredata'
221+
or type contains 'microsoft.data'
222+
or type contains 'microsoft.db'
223+
or type contains 'microsoft.documentdb'
224+
or type contains 'microsoft.sql'
225+
or type contains 'microsoft.storage')
226+
| extend fullyQualifiedDomainName = tostring(properties.fullyQualifiedDomainName)
227+
| extend size = tostring(properties.currentServiceObjectiveName)
228+
| join kind=leftouter (ResourceContainers | where type=~ 'microsoft.resources/subscriptions'
229+
| project SubName=name, subscriptionId) on subscriptionId
230+
| project type, subscriptionId, SubName, name, resourceGroup, fullyQualifiedDomainName, size, location, tags, properties, managedBy, id
231+
232+
233+
PS C:\PS1> Import-Module Az.ResourceGraph
234+
PS C:\PS1> $q = "Resources
235+
| where (type contains 'microsoft.azuredata'
236+
or type contains 'microsoft.data'
237+
or type contains 'microsoft.db'
238+
or type contains 'microsoft.documentdb'
239+
or type contains 'microsoft.sql'
240+
or type contains 'microsoft.storage')
241+
| extend fullyQualifiedDomainName = tostring(properties.fullyQualifiedDomainName)
242+
| extend size = tostring(properties.currentServiceObjectiveName)
243+
| join kind=leftouter (ResourceContainers | where type=~ 'microsoft.resources/subscriptions'
244+
| project SubName=name, subscriptionId) on subscriptionId
245+
| project type, subscriptionId, SubName, name, resourceGroup, fullyQualifiedDomainName, size, location, tags, properties, managedBy, id"
246+
247+
248+
249+
PS C:\PS1> $Results = Search-AzGraph -query $q -First 5000 ; write-host "$($Results.Count) entries"
250+
251+
PS C:\PS1> $Results | Out-GridView
252+
```
253+
254+
255+
```
256+
resources
257+
| join kind=leftouter (ResourceContainers | where type=~'microsoft.resources/subscriptions'
258+
| project SubName=name, subscriptionId) on subscriptionId
259+
260+
| project subscriptionId, SubName, resourceGroup
261+
```
262+
263+
264+
# List all resource groups, tags, and VM counts
265+
266+
```
267+
ResourceContainers
268+
| where type=~ 'microsoft.resources/subscriptions/resourcegroups'
269+
| extend ServiceOwner = tostring(tags["Service Owner"])
270+
| extend ServiceName = tostring(tags["Service Name"])
271+
| extend CostCodeID = tostring(tags["Cost Code ID"])
272+
| join kind=leftouter (Resources | where type=~ 'microsoft.compute/virtualmachines'
273+
| summarize count() by tostring(resourceGroup)
274+
| project resourceGroup, VMcount = count_) on resourceGroup
275+
| join kind=leftouter (Resources | where type contains 'microsoft.classic'
276+
| summarize count() by tostring(resourceGroup)
277+
| project resourceGroup, ClassicCount = count_) on resourceGroup
278+
| project subscriptionId, name, location, VMcount, ClassicCount, ServiceOwner, ServiceName, CostCodeID, tenantId
279+
```
280+
281+
# List all Resource Groups with tags
282+
This also pulls out a few key tags...
283+
```
284+
$KustoQuery = "resourcecontainers
285+
| where type == 'microsoft.resources/subscriptions/resourcegroups'
286+
| extend ServiceOwner = tostring(tags['Service Owner'])
287+
| extend ServiceName = tostring(tags['Service Name'])
288+
| extend CostCodeID = tostring(tags['Cost Code ID'])
289+
| join kind=leftouter (ResourceContainers | where type=~'microsoft.resources/subscriptions'
290+
| project SubName=name, subscriptionId) on subscriptionId
291+
| project id, subscriptionId, SubName, type, resourceGroup, location, tags, ServiceOwner, ServiceName, CostCodeID, tenantId, properties"
292+
$ResourceGroups = @()
293+
$SkipCount = 0
294+
Do
295+
{ # Search-AzGraph doesn't like a -SkipCount of zero
296+
if ($SkipCount -eq 0)
297+
{ $r = Search-AzGraph -query $KustoQuery -First 1000 } # -ErrorAction SilentlyContinue
298+
else
299+
{ $r = Search-AzGraph -query $KustoQuery -First 1000 -Skip $SkipCount } # -ErrorAction SilentlyContinue
300+
$ResourceGroups += $r
301+
$SkipCount += 1000
302+
}
303+
Until ($r.Count -lt 1000)
304+
```
305+
306+
307+
---
308+
## References
309+
310+
https://docs.microsoft.com/en-us/azure/kusto/query/
311+
https://docs.microsoft.com/en-us/azure/governance/resource-graph/concepts/query-language
312+
https://docs.microsoft.com/en-us/azure/governance/resource-graph/samples/starter?tabs=azure-cli
313+
https://docs.microsoft.com/en-us/azure/kusto/query/joinoperator
314+
https://docs.microsoft.com/en-us/azure/firewall/log-analytics-samples

0 commit comments

Comments
 (0)