Log Analytics :: Find Resources with no activities for the last 90 days

Question

I was reading this blog and I found out that there is a query that could return me all Resource Groups with the relative activities for the last 90 days:

AzureActivity
| where CategoryValue == "Administrative"
| where EventSubmissionTimestamp > ago(90d)
| summarize activityCount = count() by ResourceGroup
| order by activityCount asc

This is very useful but I would like to have the same but with the activities for each Resource instead of the Resource Group. So I tried this:

AzureActivity
| where CategoryValue == "Administrative"
| where EventSubmissionTimestamp > ago(90d)
| summarize activityCount = count() by Properties.Resource
| order by activityCount asc

but it's not working.

I know that the resource name is under Properties but I cannot project it.

Answer 1

I check resources activity with below KQL query:

AzureActivity
| where CategoryValue == "Administrative"
| where TimeGenerated > ago(90d)
| summarize activityCount = count() by Resource
| order by activityCount asc

Output: