LastOwnershipUpdateTime example added

johnthebrit · Apr 23, 2024 · 4e08b86 · 4e08b86
1 parent 6a93f74
commit 4e08b86
Showing 1 changed file with 7 additions and 1 deletion.
diff --git a/ResourceGraph/ExampleARG.txt b/ResourceGraph/ExampleARG.txt
@@ -159,4 +159,10 @@ Resources
 	servicehealthresources
 	| where type =~ 'Microsoft.ResourceHealth/events'
 	| extend eventType = tostring(properties.EventType), status = properties.Status, description = properties.Title, trackingId = properties.TrackingId, summary = properties.Summary, priority = properties.Priority, impactStartTime = properties.ImpactStartTime, impactMitigationTime = todatetime(tolong(properties.ImpactMitigationTime))
-| where properties.Status == 'Active' and impactStartTime > ago(40d)
+| where properties.Status == 'Active' and impactStartTime > ago(40d)
+
+#View the LastOwnershipUpdateTime of managed disks
+resources
+| where type == "microsoft.compute/disks"
+| where properties.diskState == "Unattached" and todatetime(properties.LastOwnershipUpdateTime) < ago(60d)
+| project name, id, diskState = properties.diskState, LastUpdateTime = format_datetime(todatetime(properties.LastOwnershipUpdateTime), "dd-MM-yyyy")