1

I found a list of KQL queries that are helping me digging into unused resources on Azure.

With this query for example I can see a list of Orphaned Disks:

Resources
| where type has "microsoft.compute/disks"
| extend diskState = tostring(properties.diskState)
| where managedBy == "" and diskState != 'ActiveSAS'
or diskState == 'Unattached' and diskState != 'ActiveSAS'
| project id, diskState, resourceGroup, location, subscriptionId

which nicely render into this:

enter image description here

But I would like to add 3 more columns to it:

  • Who created the resource
  • When the resource was created
  • Ideally how much it cost that resource in the last 30 days

I see that I probably have to Join AzureActivity in order to find who created the resource.

I still have no idea if KQL can help me find the costs per activity.

David דודו Markovitz
  • 42,900
  • 6
  • 64
  • 88
Francesco Mantovani
  • 10,216
  • 13
  • 73
  • 113

0 Answers0