Azure Classroomnotes 25/Dec/2021

Using Kusto Queries

  • In this session we will understand how to use KQL
  • Counting rows
TableName | count

Preview
* Order results

InsightsMetrics
| sort by TimeGenerated desc
| where Name contains "FreeSpace"
| take 10

InsightsMetrics
| where Name contains "FreeSpace"
| top 5 by TimeGenerated desc

  • Compute derived columns
    Preview
  • Display a chart or table
    Preview
    Preview
  • Joining Different records
VMComputer
|where Computer == "qtbusinessserve"
| distinct Computer, PhysicalMemoryMB
| join kind=inner ( 
    InsightsMetrics
        | where Namespace == "Memory" and Name == "AvailableMB"
        | project TimeGenerated, Computer, AvailableMemoryMB = Val
) on Computer
| project TimeGenerated, Computer, PercentageMemory = AvailableMemoryMB/PhysicalMemoryMB * 100
| render timechart 

Preview
* Exercise: Try to Create a Time series chart which projects ReadBytesPerSecond and WriteBytePerSecond with a bin = 2 hours
Preview

  • Parse Operator: Evaluates a string expression and parses the values into one or more calculated columns
T | parse Message with "
  • For parsing text Record Refer Here
  • Creating alerts from custom log queries
InsightsMetrics
| where Name == "FreeSpaceMB"
|extend FreeSpaceGb = Val/1000
| summarize AggregatedValue=avg(FreeSpaceGb) by bin(TimeGenerated, 1h) 

Preview
* Activity Logs exist at individual resources, resource groups and subscriptions as well which help in auditing the subscription for changes

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.

About continuous learner

devops & cloud enthusiastic learner