azure 从KQL查询中排除临时存储(D:)

jei2mxaa  于 2022-12-19  发布在  其他
关注(0)|答案(1)|浏览(120)

我有来自Azure Log Insights的磁盘日志的KQL查询。请让我知道如何排除特定驱动器,如D:或来自该查询的任何临时存储。

InsightsMetrics
  | where Name == "FreeSpaceMB"
  | extend Tags = parse_json(Tags)
  | extend mountId = tostring(Tags["vm.azm.ms/mountId"])
          ,diskSizeMB = toreal(Tags["vm.azm.ms/diskSizeMB"])
  | project-rename FreeSpaceMB = Val
  | summarize arg_max(TimeGenerated, diskSizeMB, FreeSpaceMB) by Computer, mountId
           ,FreeSpacePercentage = round(FreeSpaceMB / diskSizeMB * 100, 1)
  | extend diskSizeGB = round(diskSizeMB / 1024, 1)
          ,FreeSpaceGB = round(FreeSpaceMB / 1024, 1)
  | project TimeGenerated, Computer, mountId, diskSizeGB, FreeSpaceGB, FreeSpacePercentage
  | order by Computer asc, mountId asc
bf1o4zei

bf1o4zei1#

您只需要执行where语句

| where mountId != "D:"

因此在您的查询中,它将是

InsightsMetrics
  | where Name == "FreeSpaceMB"
  | extend Tags = parse_json(Tags)
  | extend mountId = tostring(Tags["vm.azm.ms/mountId"])
          ,diskSizeMB = toreal(Tags["vm.azm.ms/diskSizeMB"])
  | where mountId != "D:"
  | project-rename FreeSpaceMB = Val
  | summarize arg_max(TimeGenerated, diskSizeMB, FreeSpaceMB) by Computer, mountId
           ,FreeSpacePercentage = round(FreeSpaceMB / diskSizeMB * 100, 1)
  | extend diskSizeGB = round(diskSizeMB / 1024, 1)
          ,FreeSpaceGB = round(FreeSpaceMB / 1024, 1)
  | project TimeGenerated, Computer, mountId, diskSizeGB, FreeSpaceGB, FreeSpacePercentage
  | order by Computer asc, mountId asc

如果要从查询中排除多个驱动器,可以使用!in运算符,如下所示

InsightsMetrics
  | where Name == "FreeSpaceMB"
  | extend Tags = parse_json(Tags)
  | extend mountId = tostring(Tags["vm.azm.ms/mountId"])
          ,diskSizeMB = toreal(Tags["vm.azm.ms/diskSizeMB"])
  | where mountId !in ("D:", "E:")
  | project-rename FreeSpaceMB = Val
  | summarize arg_max(TimeGenerated, diskSizeMB, FreeSpaceMB) by Computer, mountId
           ,FreeSpacePercentage = round(FreeSpaceMB / diskSizeMB * 100, 1)
  | extend diskSizeGB = round(diskSizeMB / 1024, 1)
          ,FreeSpaceGB = round(FreeSpaceMB / 1024, 1)
  | project TimeGenerated, Computer, mountId, diskSizeGB, FreeSpaceGB, FreeSpacePercentage
  | order by Computer asc, mountId asc

相关问题