Forum Discussion

Arslan11's avatar
Arslan11
Brass Contributor
Jun 11, 2020

Help with making the query work

ConfigurationChange | where ConfigChangeType == "WindowsServices" and SvcState == "Stopped" and ( Computer has "NH-P2PAPP01.networkhg.org.uk" or Computer has “NET-P2PLIVEAPP1.networkhg.org.uk" ...
azure monitor
Query Language
Meir_Mendelovich's avatar
Meir_Mendelovich
Icon for Microsoft rankMicrosoft
Jun 14, 2020

Arslan11 ,

 

It seems to me that the query fail to parse because you were using the wrong double quote character. You used ” instead of "

 

There are many different double quote chars that some keyboards change automatically.

 

Other than the quote chars, I have slightly rewritten your query to make it more readable and easy to maintain:

 

ConfigurationChange
| where
ConfigChangeType == "WindowsServices" and
SvcState == "Stopped" and
Computer has_any ("NH-P2PAPP01.networkhg.org.uk","NET-P2PLIVEAPP1.networkhg.org.uk","NET-P2PTESTAPP.networkhg.org.uk")
and SvcDisplayName in ("Integra eSeries FINPROD","Integra SPC FINPROD","Integra UAS FINPROD","Integra eSeries FINDEV","Integra SPC FINDEV","Integra UAS FINDEV","Integra eSeries Duet","Integra eSeries SPTDEV","Integra eSeries FINARCH")
  • Arslan11's avatar
    Arslan11
    Brass Contributor
    Jun 16, 2020

    Meir_Mendelovich  Thanks, another query question to ask

     

    Perf
    | where ObjectName == "LogicalDisk" and CounterName == "% Free Space" and Computer != "net-fs3.networkhg.org.uk" and Computer != "NET-FS1.networkhg.org.uk"  and Computer != "NET-SQL3.networkhg.org.uk" and Computer != "NET-EDMLIVEDB1.networkhg.org.uk" and Computer != "NET-EDM_KOFAX1.networkhg.org.uk"
    | summarize Free_Space = min(CounterValue) by Computer, InstanceName
    | where strlen(InstanceName) == 2 and InstanceName contains ":" and Computer != "NET-REPAIR2.networkhg.org.uk" and InstanceName !contains ":E"  and Computer != "NH-E2016-01.networkhg.org.uk" and InstanceName !contains ":E" and Computer != "NH-E2016-02.networkhg.org.uk" and InstanceName !contains ":E" and Computer != "net-boxi1.networkhg.org.uk" and InstanceName !contains ":D"
    | where Free_Space < 10

     

     

    How can I make this more readable , also make sure that one instance for that computer Is not being monitored instead of all 

Resources