Home

Whats the query to use the exclude the computer from existing search filter

%3CLINGO-SUB%20id%3D%22lingo-sub-352368%22%20slang%3D%22en-US%22%3EWhats%20the%20query%20to%20use%20the%20exclude%20the%20computer%20from%20existing%20search%20filter%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-352368%22%20slang%3D%22en-US%22%3E%3CP%3ENeed%20help%20on%20excluding%20some%20computers%20name%20on%20the%20existing%26nbsp%3Bquery%20result.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20am%20using%20the%20first%20three%20letters%20from%20hostname%20filter%20the%20Country%20wise%20but%20I%20need%20exclude%20the%20domain%20servers%20from%20the%20query.%26nbsp%3B%20is%20there%20is%20have%20excluded%20query%20for%20computers%20search%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-352368%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%20Log%20Analytics%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EQuery%20Language%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-352868%22%20slang%3D%22en-US%22%3ERe%3A%20Whats%20the%20query%20to%20use%20the%20exclude%20the%20computer%20from%20existing%20search%20filter%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-352868%22%20slang%3D%22en-US%22%3E%3CP%3EHi%2C%3C%2FP%3E%0A%3CP%3EEvery%20query%20is%20a%20query%20which%20means%20you%20can%20build%20the%20query%20to%20the%20results%20you%20want%20to%20get%20or%20not%20get.%20You%20have%20multiple%20filtering%20options%20that%20allows%20you%20to%20exclude%2Finclude%20certain%20results.%20Some%20of%20the%20examples%20are%3A%3C%2FP%3E%0A%3CPRE%3EPerf%20%0A%7C%20where%20Computer%20!in~%20(%22Computer1%22%2C%20%22Computer2%22)%3C%2FPRE%3E%0A%3CP%3Eor%3C%2FP%3E%0A%3CPRE%3EPerf%0A%7C%20where%20Computer%20!%3D%20'Computer1'%20or%20Computer%20!%3D%20'Computer2'%3C%2FPRE%3E%0A%3CP%3EOr%20if%20they%20start%20with%20specific%20prefix%3A%3C%2FP%3E%0A%3CPRE%3EPerf%0A%7C%20where%20Computer%20!startswith%20%22Computer%22%0A%3C%2FPRE%3E%0A%3CP%3EPick%20whatever%20serves%20your%20needs.%3C%2FP%3E%0A%3CP%3EYou%20also%20have%20the%20possibility%20to%20build%20a%20function%3A%3C%2FP%3E%0A%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fazure-monitor%2Flog-query%2Ffunctions%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fazure-monitor%2Flog-query%2Ffunctions%3C%2FA%3E%3C%2FP%3E%0A%3CP%3EFor%20example%20your%20function%20could%20be%3C%2FP%3E%0A%3CPRE%3EHeartbeat%20%7C%20where%20Computer%20!in~%20(%22Computer1%22%2C%20%22Computer2%22)%20%7C%20distinct%20Computer%3C%2FPRE%3E%0A%3CP%3EIf%20your%20function%20is%20called%20ExcludedComptuers%20when%20you%20do%20queries%20you%20can%3A%3C%2FP%3E%0A%3CPRE%3EPerf%0A%7C%20where%20Computer%20!in~%20(ExcludedComputers)%3C%2FPRE%3E%0A%3CP%3EMark%20this%20reply%20as%20answer%20if%20it%20was%20helpful.%3C%2FP%3E%3C%2FLINGO-BODY%3E
Deleted
Not applicable

Need help on excluding some computers name on the existing query result.

 

I am using the first three letters from hostname filter the Country wise but I need exclude the domain servers from the query.  is there is have excluded query for computers search?

1 Reply

Hi,

Every query is a query which means you can build the query to the results you want to get or not get. You have multiple filtering options that allows you to exclude/include certain results. Some of the examples are:

Perf 
| where Computer !in~ ("Computer1", "Computer2")

or

Perf
| where Computer != 'Computer1' or Computer != 'Computer2'

Or if they start with specific prefix:

Perf
| where Computer !startswith "Computer"

Pick whatever serves your needs.

You also have the possibility to build a function:

https://docs.microsoft.com/en-us/azure/azure-monitor/log-query/functions

For example your function could be

Heartbeat | where Computer !in~ ("Computer1", "Computer2") | distinct Computer

If your function is called ExcludedComptuers when you do queries you can:

Perf
| where Computer !in~ (ExcludedComputers)

Mark this reply as answer if it was helpful.

Related Conversations
Tabs and Dark Mode
cjc2112 in Discussions on
36 Replies
Extentions Synchronization
Deleted in Discussions on
3 Replies
flashing a white screen while open new tab
Deleted in Discussions on
14 Replies
Stable version of Edge insider browser
HotCakeX in Discussions on
35 Replies
How to Prevent Teams from Auto-Launch
chenrylee in Microsoft Teams on
29 Replies