topic Re: Splunk report to fetch Azure orphaned disk details. in Getting Data In https://community.splunk.com/t5/Getting-Data-In/Splunk-report-to-fetch-Azure-orphaned-disk-details/m-p/678448#M113373 <P>Please share some sample (anonymised) events</P> Fri, 23 Feb 2024 09:36:51 GMT ITWhisperer 2024-02-23T09:36:51Z Splunk report to fetch Azure orphaned disk details. https://community.splunk.com/t5/Getting-Data-In/Splunk-report-to-fetch-Azure-orphaned-disk-details/m-p/678445#M113371 <P><SPAN>Hello experts... I need help... I want to fetch Azure orphaned disk details...&nbsp;Can someone share splunk query for the same.</SPAN></P> Fri, 23 Feb 2024 09:34:30 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-report-to-fetch-Azure-orphaned-disk-details/m-p/678445#M113371 jatin 2024-02-23T09:34:30Z Re: Splunk report to fetch Azure orphaned disk details. https://community.splunk.com/t5/Getting-Data-In/Splunk-report-to-fetch-Azure-orphaned-disk-details/m-p/678448#M113373 <P>Please share some sample (anonymised) events</P> Fri, 23 Feb 2024 09:36:51 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-report-to-fetch-Azure-orphaned-disk-details/m-p/678448#M113373 ITWhisperer 2024-02-23T09:36:51Z Re: Splunk report to fetch Azure orphaned disk details. https://community.splunk.com/t5/Getting-Data-In/Splunk-report-to-fetch-Azure-orphaned-disk-details/m-p/678450#M113375 <P>I am new to Splunk so I don't know from where to start.</P> Fri, 23 Feb 2024 09:40:07 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-report-to-fetch-Azure-orphaned-disk-details/m-p/678450#M113375 jatin 2024-02-23T09:40:07Z Re: Splunk report to fetch Azure orphaned disk details. https://community.splunk.com/t5/Getting-Data-In/Splunk-report-to-fetch-Azure-orphaned-disk-details/m-p/678454#M113378 <P><SPAN>I am new to Splunk so I don't know from where to start.</SPAN></P> Fri, 23 Feb 2024 09:41:57 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-report-to-fetch-Azure-orphaned-disk-details/m-p/678454#M113378 jatin 2024-02-23T09:41:57Z Re: Splunk report to fetch Azure orphaned disk details. https://community.splunk.com/t5/Getting-Data-In/Splunk-report-to-fetch-Azure-orphaned-disk-details/m-p/678455#M113379 <P>Where is the data you want to analysis? Have you already ingested it into Splunk?</P> Fri, 23 Feb 2024 09:42:24 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-report-to-fetch-Azure-orphaned-disk-details/m-p/678455#M113379 ITWhisperer 2024-02-23T09:42:24Z Re: Splunk report to fetch Azure orphaned disk details. https://community.splunk.com/t5/Getting-Data-In/Splunk-report-to-fetch-Azure-orphaned-disk-details/m-p/678687#M113414 <P>Install the <A href="https://splunkbase.splunk.com/app/3110" target="_blank" rel="noopener">Splunk Add-on for Microsoft Cloud Services</A> and configure the Azure Resource input.&nbsp; Choose "Disk Data" as the resource type (see screenshot).</P><P>Then, you can use this search to find unattached (orphaned) disks:</P><PRE>index=main sourcetype="mscs:resource:disk" properties.diskState="unattached"</PRE><P>&nbsp;</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="jconger_0-1708965359640.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/29482i923E760546E01A8F/image-size/medium?v=v2&amp;px=400" role="button" title="jconger_0-1708965359640.png" alt="jconger_0-1708965359640.png" /></span></P><P>&nbsp;</P> Mon, 26 Feb 2024 16:37:42 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-report-to-fetch-Azure-orphaned-disk-details/m-p/678687#M113414 jconger 2024-02-26T16:37:42Z