Skip to main content
Splunk Lantern

Cost calculation for unattached Azure managed disks

You might want to calculate the cost unattached disks and report to management when doing the following:

Prerequisites 

In order to execute this procedure in your environment, the following data, services, or apps are required:

Example

When you delete a virtual machine (VM) in Azure, by default, any disks that are attached to the VM aren't deleted. This helps to prevent data loss due to the unintentional deletion of VMs. However, after a VM is deleted, you continue to pay for unattached disks. You want to calculate the cost  unattached disks as a justification to take action.

To optimize the search shown below, you should specify an index and a time range.

  1. Run the following search: 
sourcetype=azure:billing
[ search sourcetype = azure:compute:disk properties.diskState = Unattached 
    |stats count BY id 
    |fields id 
    |rename id AS properties.instanceId]
|dedup id 
|rename properties.pretaxCost AS cost 
|stats sum(cost) AS Cost by properties.instanceId 
|fieldformat Cost="$".round(Cost, 2) 
|table idCount properties.instanceId Cost 
|rename properties.instanceId AS "Instance ID" 
|addcoltotals

Search explanation

The table provides an explanation of what each part of this search achieves. You can adjust this query based on the specifics of your environment.

Splunk Search Explanation

sourcetype=azure:billing

Search only Azure billing data. 

[ search sourcetype = azure:compute:disk properties.diskState = Unattached 

Start a subsearch of the Azure disk data to return unattached disks. The results from this sub search will be correlated with the results from the billing data found in the primary or outer search. 

| stats count BY id 

    | fields id 

    | rename id AS properties.instanceId] 

Count the results by id, limit the return to one field, and rename it "properties.instanceId", which is a field in the billing data. The other search will filter on this value returned here. 

|dedup id 

Remove duplicate results by ID.

|rename properties.pretaxCost AS cost

Rename the fields as shown for better readability.

|stats sum(cost) AS Cost by properties.instanceId

Calculate the cost.

|fieldformat Cost="$".round(Cost, 2)

Round the cost to two decimal places and concatenate the $ sign.

|table properties.instanceId Cost 

Display the results in a table with columns in the order shown.

|rename properties.instanceId AS "Instance ID"

Rename the fields as shown for better readability.

|addcoltotals

Add and display the cost column total.

Result

Sample results for this search are shown in the table below. In the example, the cost numbers are low because the sample is small. In your environment, the cost may be significant and you would want to know. 

properties.instanceName Cost

Test_OsDisk_1_32e1685f3eb247659c42cee472ce0b90

$1.16

brewer_disk1_96f7bb62aaca41c482ea7154996a91ff

$0.72

test_OsDisk_1_f4433b58935a4a57bea498f0ef1ea0d2

$0.11

 

$1.98

To enhance this search, use the billing account ID or account name to back track the disk to the owner. Note that using a subsearch is more expensive than using a lookup. The subsearch is easy to construct but for a more efficient approach, build a saved search to get all your unattached disk info and save it to a lookup file. Schedule it to run periodically, such as once per day. Then, update the search shown here to use an inputlookup rather than the subsearch. 

  • Was this article helpful?