CODEWITHSUNDEEP
azure-data-explorerkqlazure-resource-graph
sepp
sepp

Reputation: 13

KQL / Azure Resource Graph Explorer: combine values from multiple records

I am trying to fetch all public ips and fqdns configured for a set of load balancers in azure resource graph explorer. I am getting all the data I need with the following query:

Resources
| where type =~ 'Microsoft.Network/loadBalancers'
| where subscriptionId =~ '11111111-2222-3333-4444-555555555555'
| where resourceGroup =~ 'resource-group-name'
| mv-expand ipConfig=properties.frontendIPConfigurations
| project name, publicIpId = tostring(ipConfig.properties.publicIPAddress.id)
| join kind=leftouter (
    Resources
    | where type =~ 'microsoft.network/publicipaddresses'
    | project publicIpId = id, publicIpAddress = tostring(properties.ipAddress), fqdn = tostring(properties.dnsSettings.fqdn)
)
on publicIpId
| summarize by name, publicIpAddress, fqdn

But the result is in the form of:

name              publicIpAddress       fqdn
outbound-lb       x.y.z.1               a domain
frontend-lb       x.y.z.2               another domain
frontend-lb       x.y.z.3               third domain
services-lb       x.y.z.4               fourth domain

and what I need is:

name              publicIpAddress       fqdn
outbound-lb       x.y.z.1               a domain
frontend-lb       x.y.z.2, x.y.z.3      another domain, third domain
services-lb       x.y.z.4               fourth domain

I have been looking at the summarize make_list() function but was not successful in getting the result I need!

Upvotes: 1

Views: 1069

Answers (1)

Yoni L.
Yoni L.

Reputation: 25895

you could try replacing this:

| summarize by name, publicIpAddress, fqdn

with this:

| summarize publicIpAddress = strcat_array(make_set(publicIpAddress), ", "), 
            fqdn = strcat_array(make_set(fqdn), ", ")
         by name

Upvotes: 2

Related Questions