How do I parse Kusto Query output into Automation Script (Powershell or Python)-CodePudding

I have a Kusto query that will output for me processes from my VMs (whether they are stopped or not).

Here is the query:

ConfigurationData 
| project Computer, SvcName, SvcDisplayName, SvcState, TimeGenerated, _ResourceId
| distinct Computer, SvcName, SvcDisplayName, SvcState, TimeGenerated , _ResourceId
| where SvcName =~ "{process_name}" 
| where SvcState != "Running"

I need to parse the ComputerName (Computer) to an Automation Script so that it simply turns on the process that is not running.

How can I achieve this?

Would it be wiser to just run the KQL code in the automation script directly? But then, how can I trigger it? It needs to check every 5 mins whether the process is running. I suppose I could do a scheduling task.

I'm still trying to work at ways of parsing the KQL output to an automation script

CodePudding user response：

I would start by fixing the KQL query.

It is not retrieving services that are currently not running, it retrieves services that in some point in time were not running.

You should retrieve the last record for each service (running on a specific computer).

ConfigurationData 
| where SvcName =~ "{process_name}" 
| project Computer, SvcDisplayName, SvcState, TimeGenerated, _ResourceId
| summarize arg_max(TimeGenerated, *) by Computer
| where SvcState != "Running"

CodePudding user response：

One way is doing with Kusto query, the other way which I do is by using PowerShell commands as below and I followed SO-thread:

$vm = Get-Azvm -Status

foreach($emos in $vm)
{
   $sc = Get-AzVM -ResourceGroupName $emos.ResourceGroupName -Name $emos.Name -Status 
    if($sc.Statuses.DisplayStatus[1] -eq "VM running")
    {
Write-Output "Already started"   $emos
    }
else{
Write-Output "Started now"   $emos
Start-AzVM -ResourceGroupName $emos.ResourceGroupName -Name $emos.Name
}

And you can schedule a recurrence in Automation as below after creating the above job in run book as below:

enter image description here

Or else you can use the above PowerShell Script in Azure PowerShell Functions, after that you can use timer Trigger function.