Forum Discussion

Arslan11's avatar
Arslan11
Copper Contributor
Jun 10, 2020

Azure monitoring Kusto query

Perf | where ObjectName == "LogicalDisk" and CounterName == "% Free Space" and Computer != "net-fs3.networkhg.org.uk" and Computer != "NET-FS1.networkhg.org.uk" and Computer != "NET-SQL3.networkhg.o...
monitoring
CliveWatson's avatar
CliveWatson
Former Employee
Jun 11, 2020

-Akos- 

 

Some other ideas, I prefer to reduce the amount of "or"'s and replace with an "in" or "!in"

search "Heartbeat"
| where Computer in ("computerA","computerB","computerC" ,"computerD")
| distinct Computer

 

or

 

let computerList = dynamic(["computerA","computerB","computerC" ,"computerD"]);
search "Heartbeat"
| where Computer in (computerList)
| distinct Computer

 

FYI,
Home - Azure -  Azure Log Analytics  (in another forum to use on this platform for KQL help)

 

Arslan11's avatar
Arslan11
Copper Contributor
Jun 11, 2020

CliveWatson  thanks my question towards, how can avoid one instance name  not be monitored on a server instead of avoiding all the instance name when using the language specified below

 

and Computer != "NH-E2016-01.networkhg.org.uk" and InstanceName !contains ":E"

Resources