Forum Discussion

Deleted's avatar
Deleted
Feb 18, 2019

Whats the query to use the exclude the computer from existing search filter

Need help on excluding some computers name on the existing query result.

 

I am using the first three letters from hostname filter the Country wise but I need exclude the domain servers from the query.  is there is have excluded query for computers search?

azure monitor
Query Language
  • Stanislav_Zhelyazkov's avatar
    Stanislav_Zhelyazkov
    MVP
    Feb 19, 2019

    Hi,

    Every query is a query which means you can build the query to the results you want to get or not get. You have multiple filtering options that allows you to exclude/include certain results. Some of the examples are:

    Perf 
| where Computer !in~ ("Computer1", "Computer2")

    or

    Perf
| where Computer != 'Computer1' or Computer != 'Computer2'

    Or if they start with specific prefix:

    Perf
| where Computer !startswith "Computer"

    Pick whatever serves your needs.

    You also have the possibility to build a function:

    https://docs.microsoft.com/en-us/azure/azure-monitor/log-query/functions

    For example your function could be

    Heartbeat | where Computer !in~ ("Computer1", "Computer2") | distinct Computer

    If your function is called ExcludedComptuers when you do queries you can:

    Perf
| where Computer !in~ (ExcludedComputers)

    Mark this reply as answer if it was helpful.

Resources