Heartbeat query, show negative results

ScottAllison 

Have a look at this example: Go to Log Analytics and Run Query

You will need to add in your own myList values and make some other minor edits 

//
// I have filtered on Computers starting with "A" to make the list smaller - remove or edit as required
//
// First, generarte a list of all computers from Heartbeat table into an array
let myServers = toscalar(Heartbeat 
| where Computer startswith "A" 
| distinct Computer
| summarize make_set(Computer));  
// Now define my list of computers as an array
let myList = dynamic(["aFakeComputer","ad-primary-dc.contoso.com","ad-secondary-dc.contoso.com","fakeComputer"]); 
Heartbeat
| where Computer startswith "A" 
| distinct Computer
// compare the two arrays, show only values that are not in the 2nd array 
| project ComputersNotInHeatBeat = set_difference(myList, myServers)
| distinct tostring(ComputersNotInHeatBeat)

Results, look like this: