azure-log-analyticsazure-log-analytics-workspace

Log Analytics :: Find Resources with no activities for the last 90 days


I was reading this blog and I found out that there is a query that could return me all Resource Groups with the relative activities for the last 90 days:

AzureActivity
| where CategoryValue == "Administrative"
| where EventSubmissionTimestamp > ago(90d)
| summarize activityCount = count() by ResourceGroup
| order by activityCount asc

This is very useful but I would like to have the same but with the activities for each Resource instead of the Resource Group. So I tried this:

AzureActivity
| where CategoryValue == "Administrative"
| where EventSubmissionTimestamp > ago(90d)
| summarize activityCount = count() by Properties.Resource
| order by activityCount asc

but it's not working.

I know that the resource name is under Properties but I cannot project it.


Solution

  • I check resources activity with below KQL query:

    AzureActivity
    | where CategoryValue == "Administrative"
    | where TimeGenerated > ago(90d)
    | summarize activityCount = count() by Resource
    | order by activityCount asc
    

    Output:

    enter image description here