azureazure-arc

KML query to group software by computer from ConfigurationData table


Synopsis: I need help with KML syntax to query Azure logs and return summary rows with expanded detail rows.

Question: We have several servers managed in Azure Arc, and Azure's logs include a Change Tracking > ConfigurationData table where the current software is listed. I'm trying to understand KML syntax to query this log for results as follows: One row per distinct SoftwareName (and its total count) and expand that row to show the computer(s) that have that softwareName installed.

I haven't mastered KQL language, and I don't know if this type of result is possible or if the general layout is not designed for this. Apologies if this is not the correct site, but I see other Azure related questions here.

Details: Here's an example query of all data I'm looking to retrieve:

ConfigurationData
| where ConfigDataType == "Software" and SoftwareType == "Application"
| summarize Count = count() by SoftwareName
| join kind=inner (
    ConfigurationData
    | where ConfigDataType == "Software" and SoftwareType == "Application"
    | project Computer, SoftwareName
) on SoftwareName
| project SoftwareName, Count, Computer
| order by SoftwareName asc

And it returns this:

enter image description here

What I want is essentially this, but with a distinct list of results - so the first software should only appear 1x (not 4x), and obviously I wouldn't include the Computer column at this level. Expanding the row should show all four Computers that have it installed).

Does anyone know the syntax to get there? (Or similar)? Thanks!


Solution

  • KML query to group software by computer from Configuration Data table: -

    To achieve your requirement, you can use make_list() function available in Kusto which retrieves a list of computers by filtering it with specific software and config data type.

    ConfigurationData
    | where ConfigDataType == "Software" and SoftwareType == "Application"
    | summarize 
        Count = count(), 
        computerinfo = make_list(Computer) 
      by SoftwareName
    | project SoftwareName, Count, computerinfo
    | order by SoftwareName asc
    

    Output:

    As I am not having much data elated to the configuration of arc resources, I have applied the same logic to the Heartbeat table in the VM as shown below and it worked as expected.

    enter image description here