KQL Search

This query is designed to be run in the Resource Graph Explorer within Microsoft Azure. It focuses on tracking changes to the virtual machine (VM) sizes in your Azure resources. Here's a simple breakdown of what the query does:

1. Data Source: It retrieves data from the resourcechanges table, which contains information about changes made to Azure resources.

2. Extracting Information: The query extracts specific details from the data:

   • vmSize: The size of the virtual machine, both before and after the change.
   • changeTime: The timestamp when the change occurred.
   • targetResourceId: The unique identifier of the resource that was changed.
   • changeType: The type of change that was made (e.g., update, delete).

3. Filtering: It filters the results to only include records where the VM size information is not empty, ensuring that only relevant changes are considered.

4. Sorting: The results are sorted in descending order based on the changeTime, so the most recent changes appear first.

5. Projection: The query selects and displays specific columns:

   • changeTime: When the change happened.
   • targetResourceId: The ID of the resource that was changed.
   • changeType: The nature of the change.
   • properties.changes: Detailed information about the changes.
   • previousSize: The VM size before the change.
   • newSize: The VM size after the change.
   • properties.changeAttributes.changedBy: Who made the change.
   • properties.changeAttributes.clientType: The type of client used to make the change.

Overall, this query helps you monitor and analyze changes to VM sizes in your Azure environment, providing insights into what changes were made, when, and by whom.