CODEWITHSUNDEEP
azure-data-explorerkql
Milo_Dev
Milo_Dev

Reputation: 415

Kusto query help for Condition filter

I am writing a Kusto query to create a Dashboard to display health of the VM´s. The VM name, status, mode, enabled status are available in the signgl kusto table

Below is the query to list the VM´s

VM
| where VMName has "XYZ" 
| where  VMName !has "XYZ123"
| where VMName has_any ("s","t","u","v")

I need to do 1 more filter which would be to identify the VM with status and assigned to variables as belowenter code here

enabled = "mode =online & enabled =true"
disabled = "mode =offline & enabled =true"
total = enabled + disabled

from here I will calculate the total count and percent of enabled VM´s to display in Dashboard.

But I could not use operator "where" to do this. Could you please help me as I am stuck here with no solution. Thanks for the support.

Upvotes: 1

Views: 1332

Answers (1)

Avnera
Avnera

Reputation: 7608

You can use the summarize and countif() function, here is an example that assumes that you have a column called state that has the values "online" and "offline" and a column that is called mode that is "enabled" or "disabled"

VM
| where VMName has "XYZ" 
| where  VMName !has "XYZ123"
| where VMName has_any ("s","t","u","v")
| summarize Total = count(), EnabledCount = countif(mode == "online" and state=="enabled"), DisabledCount= countif(mode == "offline" and state=="enabled")

Upvotes: 0

Related Questions