Splunk report to fetch Azure orphaned disk details.

[jatin]

Hello experts... I need help... I want to fetch Azure orphaned disk details... Can someone share splunk query for the same.

[jconger]

Install the Splunk Add-on for Microsoft Cloud Services and configure the Azure Resource input.  Choose "Disk Data" as the resource type (see screenshot).

Then, you can use this search to find unattached (orphaned) disks:

index=main sourcetype="mscs:resource:disk" properties.diskState="unattached"

jconger_0-1708965359640.png

[jatin]

I am new to Splunk so I don't know from where to start.

[ITWhisperer]

Where is the data you want to analysis? Have you already ingested it into Splunk?

[ITWhisperer]

Please share some sample (anonymised) events

[jatin]

I am new to Splunk so I don't know from where to start.