KQL Search

This query is designed to be run in the Resource Graph Explorer in Azure. It focuses on tracking changes to the virtual machine (VM) sizes within your Azure resources. Here's a simplified breakdown of what the query does:

1. Data Source: It starts by accessing the resourcechanges table, which contains records of changes made to Azure resources.

2. Extract Information: It extracts specific details from each change record:

   • vmSize: The size of the virtual machine before and after the change.
   • changeTime: The timestamp when the change occurred.
   • targetResourceId: The unique identifier of the resource that was changed.
   • changeType: The type of change that was made (e.g., update, delete).

3. Filter: It filters the records to only include those where the VM size (vmSize) has changed.

4. Sort: The results are sorted in descending order based on the changeTime, so the most recent changes appear first.

5. Select Columns: Finally, it selects and displays specific columns:

   • changeTime: When the change happened.
   • targetResourceId: The ID of the resource that was changed.
   • changeType: The type of change.
   • properties.changes: Detailed information about the changes.
   • previousSize: The VM size before the change.
   • newSize: The VM size after the change.
   • properties.changeAttributes.changedBy: Who made the change (commented out in the original query).
   • properties.changeAttributes.clientType: The client type used to make the change.

This query helps you monitor and understand changes to VM sizes in your Azure environment, providing insights into what changes were made, when, and by whom.