如何修正KQL查询以支持多VirtualMachines参数选择？

问题出在当多选VM时，{VirtualMachines:label}会输出逗号分隔的单一字符串（例如"VM01,VM02"），但KQL的in运算符需要的是独立的字符串值列表，直接代入会触发语法解析错误。

修正方法很简单，用split函数把逗号分隔的参数值拆分成字符串数组，让in能正确识别每个VM名称：

InsightsMetrics
| where Origin == "vm.azm.ms"
| where Namespace == "LogicalDisk" and Name == "FreeSpacePercentage"
| extend Disk=tostring(todynamic(Tags)["vm.azm.ms/mountId"])
| extend vmName = tostring(toupper(Computer))
| extend VM_Name = tostring(split(vmName,'.')[0]) 
| summarize AggregatedValue = avg(Val) by VM_Name, Disk, _ResourceId
| where VM_Name in (split('{VirtualMachines:label}', ','))
| top 30 by AggregatedValue asc

如果参数值可能包含空格（比如名称前后有冗余空格），可以再加一步去除空格的处理，确保匹配准确：

InsightsMetrics
| where Origin == "vm.azm.ms"
| where Namespace == "LogicalDisk" and Name == "FreeSpacePercentage"
| extend Disk=tostring(todynamic(Tags)["vm.azm.ms/mountId"])
| extend vmName = tostring(toupper(Computer))
| extend VM_Name = tostring(split(vmName,'.')[0]) 
| summarize AggregatedValue = avg(Val) by VM_Name, Disk, _ResourceId
| let selectedVMs = split('{VirtualMachines:label}', ',') | trim(' ', @);
| where VM_Name in (selectedVMs)
| top 30 by AggregatedValue asc

内容的提问来源于stack exchange，提问作者ggffgg