Inventory of unattached Azure managed disks

You might want to identify and delete any unattached disks when doing the following:

• Managing Azure cloud infrastructure

Prerequisites 

In order to execute this procedure in your environment, the following data, services, or apps are required:

• Microsoft Azure Add-on for Splunk

Example

When you delete a virtual machine (VM) in Azure, by default, any disks that are attached to the VM aren't deleted. This helps to prevent data loss due to the unintentional deletion of VMs. However, after a VM is deleted, you continue to pay for unattached disks. You want to identify and delete any unattached disks so you can reduce unnecessary costs.

NOTE: To optimize the search shown below, you should specify an index and a time range.

1. Run the following search: 

sourcetype="azure:compute:disk"
|search properties.diskState="Unattached"
|dedup id 
|stats latest(location) AS Location latest(managedBy) AS managedBy latest(name) AS name latest(properties.creationData.imageReference.id) AS imageReference latest(properties.diskSizeGB) AS diskSize latest(properties.diskState) AS diskState latest(properties.osType) AS osType latest(properties.provisioningState) AS provisioningState latest(sku.name) AS skuName latest(sku.tier) AS skuTier BY id 
|table name diskState diskSize osType provisioningState skuName skuTier 
|rename name AS Name diskState AS "Disk State" diskSize AS "Disk Size (GB)" osType AS "OS Type" provisioningState AS "Provisioning State" skuName AS "SKU Name" skuTier AS "SKU Tier"

Search explanation

The table provides an explanation of what each part of this search achieves. You can adjust this query based on the specifics of your environment.

Result

Sample results for this search are shown in the table below. The value of this data is getting a list of unattached disks that may be eligible for deletion or archival to reduce cost. When working with cloud infrastructure, it is important to search for and find things that may no longer be in use by your organization but may still be incurring charges. For a search that will help you calculate costs of unattached storage, click here.