Inventory of Azure virtual machines

Data required 

Microsoft: Azure virtual machine data

Procedure

1. Configure the Splunk Add-on for Microsoft Cloud Services.
2. Run the following search. You can optimize it by specifying an index and adjusting the time range.

sourcetype="mscs:resource:virtualMachine"
|fillnull tags{} value="No Tags!"
|fillnull properties.instanceView.extensions{}.name value="" 
|stats latest(power_state) BY vm_name, location, properties.storageProfile.imageReference.offer, properties.storageProfile.imageReference.sku ,vm_size, tags{}, properties.instanceView.extensions{}.name 
|eval mem_capacity=(mem_capacity/1024/1024/1024) 
|fields - count 
|rename vm_name AS "VM Name" latest(power_state) AS Status vm_size AS Size properties.storageProfile.imageReference.offer AS OS properties.storageProfile.imageReference.sku AS Version mem_capacity AS "Memory GB" location_name AS Location cpu_cores AS CPU tags{} AS Tags properties.instanceView.extensions{}.name AS Extensions

Search explanation

The table provides an explanation of what each part of this search achieves. You can adjust this query based on the specifics of your environment.

Next steps

Sample results for this search are shown in the table below. The status field can be an important item to monitor for cost saving reasons. A status of stopped (not shown below) indicates a VM that had the OS shut down or stopped, but the VM is still allocated and is costing money. Finding those and having the VM deallocated would be useful. 

You might also be interested in other processes associated with the Managing Azure cloud infrastructure use case.