Kusto Tips & Snippets

KQL is case-sensitive for everything – table names, table column names, operators, functions, and so on.

// Virtual Machine Percentage Free Disk Space
Perf 
| where ObjectName == "Logical Disk"
| where InstanceName == "/"
| where CounterName == "% Free Space"
| summarize arg_max(TimeGenerated, *) by Computer
| project TimeGenerated, Computer, InstanceName, round(CounterValue, 2)
// Virtual Machine Percentage Free Disk Space
Perf 
| where ObjectName == "Logical Disk"
| where CounterName == "% Free Space"
| where InstanceName matches regex @'(^\/$)|(\/data)'
// Virtual Machine Percentage Free Disk Space
Perf 
| where ObjectName == "Logical Disk"
| where CounterName == "% Free Space"
| where InstanceName matches regex @'(^\/$)|(\/data)'
| sort by TimeGenerated asc nulls first 
// Virtual Machine Percentage Free Disk Space
Perf 
| where ObjectName == "Logical Disk"
| where CounterName == "% Free Space"
| where InstanceName matches regex @'(^\/$)|(\/data)'
| summarize arg_max(TimeGenerated, *) by Computer, InstanceName // arg_max over TimeGenerated returns the latest record
| project TimeGenerated, Computer, InstanceName, CounterValue
Perf
| where ObjectName == "Logical Disk" and CounterName == "% Free Space"
| where InstanceName matches regex @'(^\/$)|(\/data)'
| extend ComputerDrive = strcat(Computer, ' - ', InstanceName)
| summarize Used_Space_Percent = max(CounterValue) by ComputerDrive, bin(TimeGenerated, 1h)
| render timechart 

About

I'm a technology professional who's been passionate about computers since my Grandad introduced me to an Intel 386 back in the 90s when I was a kid. Those moments inspired a passion within for technology, and I've been playing around with anything with a circuit board ever since. Whenever I have a moment you can probably find me working on something computer-related, and this is where I like to write about those moments.