InsightsMetrics
| where Namespace == "LogicalDisk"
| where Name == "FreeSpacePercentage"
| where TimeGenerated > ago(5m)
| extend Disk=tostring(todynamic(Tags)["vm.azm.ms/mountId"])
| extend UsedSpacePercentage = 100 - Val
| summarize arg_max(TimeGenerated, *) by Disk, Computer
| project TimeGenerated, Disk, Computer, UsedSpacePercentage
| where UsedSpacePercentage > 25