在Azure资源图中连接KQL中的两个表

9jyewag0  于 2023-06-24  发布在  其他
关注(0)|答案(1)|浏览(109)

我试图列出所有具有Standard_LRS磁盘类型的Azure虚拟机,我在Azure Resource Graph Explorer中编写了此KQL查询以获得以下内容:

resources
| where type == "microsoft.compute/virtualmachines" and subscriptionId == "xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxx"
| extend id = tostring(properties.storageProfile.osDisk.managedDisk.id)
| project vm_name=name, id
| join (resources 
| where type == "microsoft.compute/disks" and subscriptionId == "xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxx" and sku.name == "Standard_LRS"
| project name, id, type=sku.name) on id
| project vm_name, disk_id=id, type

我有9个虚拟机,其中7个运行Standard_LRS托管磁盘,但此查询的结果只显示其中4个。不知道我做错了什么。如果我单独运行上面结合的两个查询,每个查询都会给我预期的结果,但是将它们合并起来会给我带来麻烦。
有线索吗?

wlwcrazw

wlwcrazw1#

找到了根本原因。磁盘id需要小写,因为它的格式永远不一致,这会扰乱连接操作。下面是相同的查询,其中一些更改使其工作:

resources
| where type == "microsoft.compute/virtualmachines" 
| extend id = tolower(tostring(properties.storageProfile.osDisk.managedDisk.id))
| project vm_name=name, id
| join (resources | extend id = tolower(id)
| where type == "microsoft.compute/disks" and sku.name == "Standard_LRS"
| project name, id, type=sku.name) on id
| project vm_name, disk_id=id, type

相关问题