'Azure Graph Query in az graph query command

Resources
| where type has "microsoft.compute/disks"
| extend diskState = tostring(properties.diskState)
| where managedBy == ""
or diskState == 'Attached'
or diskState == 'Unattached'
| project name, diskState,managedBy,resourceGroup, location, subscriptionId, properties.diskSizeGB, properties.timeCreated

How do I convert this KQL Query into a az graph query command?

azureazure-functionsazure-sql-database


Solution 1:[1]

I'm from the Microsoft for Founders Hub team. I was able to run this and it worked as intended:

az graph query -q 
"Resources
| where type has 'microsoft.compute/disks'
| extend diskState = tostring(properties.diskState)
| where managedBy == ''
or diskState == 'Attached'
or diskState == 'Unattached'
| project name, diskState,managedBy,resourceGroup, location, subscriptionId, properties.diskSizeGB, properties.timeCreated"

Upon reviewing your code block you submitted:

az graph query -q “
Resources 
| where type =~ ‘microsoft.compute/disks’ 
| extend diskState = tostring(properties.diskState) 
| where managedBy == "" or diskState == 'Attached' or diskState == 'Unattached' 
| project name, diskState,managedBy,resourceGroup, location, subscriptionId, diskSize=properties.diskSizeGB, timeCreation=properties.timeCreated
” 
--query ‘
data[].{Disk_Name:name, Disk_State:diskState, Managed_By:managedBy, Resource_Group:resourceGroup, Location:location, Subscription_Id:subscriptionId, Disk_Size:diskSize, Time_of_Creation:timeCreation}
’ 
-o tsv

I noticed you have two "query" parameters and you have double quotes within your query. Please convert the double quotes to single quotes and only use one query parameter.

Please review this for more information: https://docs.microsoft.com/en-us/azure/governance/resource-graph/concepts/explore-resources

Sources

This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.

Source: Stack Overflow

Solution Source
Solution 1 Jeremy Caney

Related Questions