Kusto Tips & Snippets

KQL is case-sensitive for everything – table names, table column names, operators, functions, and so on.

// Virtual Machine Percentage Free Disk Space
Perf 
| where ObjectName == "Logical Disk"
| where InstanceName == "/"
| where CounterName == "% Free Space"
| summarize arg_max(TimeGenerated, *) by Computer
| project TimeGenerated, Computer, InstanceName, round(CounterValue, 2)
// Virtual Machine Percentage Free Disk Space
Perf 
| where ObjectName == "Logical Disk"
| where CounterName == "% Free Space"
| where InstanceName matches regex @'(^\/$)|(\/data)'
// Virtual Machine Percentage Free Disk Space
Perf 
| where ObjectName == "Logical Disk"
| where CounterName == "% Free Space"
| where InstanceName matches regex @'(^\/$)|(\/data)'
| sort by TimeGenerated asc nulls first 
// Virtual Machine Percentage Free Disk Space
Perf 
| where ObjectName == "Logical Disk"
| where CounterName == "% Free Space"
| where InstanceName matches regex @'(^\/$)|(\/data)'
| summarize arg_max(TimeGenerated, *) by Computer, InstanceName // arg_max over TimeGenerated returns the latest record
| project TimeGenerated, Computer, InstanceName, CounterValue
Perf
| where ObjectName == "Logical Disk" and CounterName == "% Free Space"
| where InstanceName matches regex @'(^\/$)|(\/data)'
| extend ComputerDrive = strcat(Computer, ' - ', InstanceName)
| summarize Used_Space_Percent = max(CounterValue) by ComputerDrive, bin(TimeGenerated, 1h)
| render timechart