Forum Discussion

Iron Contributor

Feb 10, 2020

Solved

query multiple "contains"

Greetings Community, I'm trying to come up with a way to query for multiple computers, but I have different strings to search for. For example: Heartbeat | where TimeGenerated >= ago(1h) | w...

Feb 10, 2020

Sorry for being slow on the uptake, string is the search criteria (or pattern match you want) within the computer name column? e.g.

Heartbeat
| extend CompBucket = case(Computer contains "aks", Computer, 
                           Computer contains "Con", Computer
                           ,"")
| where isnotempty(CompBucket)

Heartbeat
| where Computer contains "aks" 
     or Computer contains "Con"
| project Computer

CliveWatson

Former Employee

Feb 10, 2020

ScottAllison

Sorry for being slow on the uptake, string is the search criteria (or pattern match you want) within the computer name column? e.g.

Heartbeat
| extend CompBucket = case(Computer contains "aks", Computer, 
                           Computer contains "Con", Computer
                           ,"")
| where isnotempty(CompBucket)

Heartbeat
| where Computer contains "aks" 
     or Computer contains "Con"
| project Computer

ScottAllison

Iron Contributor

Feb 10, 2020

Gotcha... it's all a little onerous, but I guess it's what I've got. It'd be nice to send an array instead of "or" or "case" statements. I'll add that as an enhancement.

Thanks again Clive!

Mancker
Copper Contributor
Oct 07, 2020
ScottAllison I come across the same problem. Can you please share the solution based on array?