Forum Discussion
Log Analytics query filter select multiple accounts
marwedit, you just have to add a different condition to the query:
SigninLogs
| where OperationName == "Sign-in activity" and (UserPrincipalName in~ ('auobrien.david@outlook.com','john.doe@outlook.com','mary.jones@outlook.com') or UserPrincipalName startswith "svc_")
See here a full list of the string operators you can use.
Hope that helps!
Microsoftmarwedit, would something like this be OK?
SigninLogs
| where OperationName == "Sign-in activity" and UserPrincipalName in~ ('auobrien.david@outlook.com','john.doe@outlook.com','mary.jones@outlook.com')
hspinto Thanks for the reply! I tried it and it works great. Thanks! This tackles the multiple query problem since I can put multiple users in one. One more question. Do you know of a way I could enter a wildcard in the filter so new service accounts (svc_*) are automatically added? When I replace part of the username with * it just ignores it.
- hspinto
marwedit, you just have to add a different condition to the query:
SigninLogs
| where OperationName == "Sign-in activity" and (UserPrincipalName in~ ('auobrien.david@outlook.com','john.doe@outlook.com','mary.jones@outlook.com') or UserPrincipalName startswith "svc_")
See here a full list of the string operators you can use.
Hope that helps!