Query

arg("").Resources
| where type == "microsoft.hybridcompute/machines"
| summarize Total = dcount(id), SampleDevices = make_set(name, 10) by resourceGroup

About this query

Onboarded Machines by Resource Group

Query Information

Description

This query lists the amount of onboarded Azure Arc Machines for each resourceGroup.

Sentinel

Explanation

This query is designed to provide a summary of Azure Arc Machines that have been onboarded, organized by their resource group. Here's a breakdown of what the query does in simple terms:

Data Source: It starts by accessing the Resources table, which contains information about various resources in Azure.
Filter: It filters the data to only include resources of the type "microsoft.hybridcompute/machines". This means it is specifically looking at Azure Arc Machines.
Summarize: The query then summarizes the data by:
- Counting the distinct number of machine IDs (dcount(id)) for each resource group, which gives the total number of onboarded machines in each group.
- Creating a sample set of up to 10 machine names (make_set(name, 10)) for each resource group, providing a small example of the machines present in each group.
Output: The result is a list showing each resource group, the total number of onboarded machines in that group, and a sample of machine names from each group.

KQL Search

Onboarded Machines By Resource Group