Forum Discussion

Bob Clements's avatar
Bob Clements
Copper Contributor
Jan 12, 2018

Query with SCCM ComputerGroup

The following documentation provides some example queries using Computer Groups: https://docs.microsoft.com/en-us/azure/log-analytics/log-analytics-computer-groups   I am attempting to run a qu...
azure monitor
Query Language
Meir_Mendelovich's avatar
Meir_Mendelovich
Icon for Microsoft rankMicrosoft
Jan 14, 2018

Hi Bob,

 

Please provide us some more details so we can help you.

Does the following queries provide any results?

 

  1. ComputerGroup | where GroupSource == "SCCM" and Group == "Collection 001" | distinct Computer
  2. ComputerGroup | where GroupSource == "SCCM" and Group == "Collection 001" and TimeGenerated > ago(2d) | distinct Computer
  3. ComputerGroup | where GroupSource == "SCCM" and Group == "Collection 002" | distinct Computer
  4. ComputerGroup | where GroupSource == "SCCM" and Group == "Collection 002" and TimeGenerated > ago(2d) | distinct Computer

 

BTW: you forgot the "distinct Computer" in the Collection 002 query.

 

Thanks,

Meir 

  • Bob Clements's avatar
    Bob Clements
    Copper Contributor
    Jan 16, 2018

    Hi Meir,

     

    All 4 of the queries that you provided work as expected. I receive the list of computers that correspond to the different groups. 

     

    How would I take these results and run them against a table search? For example, one of the following conditions:

     

    WaaSDeploymentStatus | where Computer in (WaaSGroup) | where DeploymentStatus=="Failed"


UADriver | where Computer in (DriverGroup) | where Issue == "Driver will not migrate to new OS"