Whats the query to use the exclude the computer from existing search filter

Deleted
Not applicable

Need help on excluding some computers name on the existing query result.

 

I am using the first three letters from hostname filter the Country wise but I need exclude the domain servers from the query.  is there is have excluded query for computers search?

1 Reply

Hi,

Every query is a query which means you can build the query to the results you want to get or not get. You have multiple filtering options that allows you to exclude/include certain results. Some of the examples are:

Perf 
| where Computer !in~ ("Computer1", "Computer2")

or

Perf
| where Computer != 'Computer1' or Computer != 'Computer2'

Or if they start with specific prefix:

Perf
| where Computer !startswith "Computer"

Pick whatever serves your needs.

You also have the possibility to build a function:

https://docs.microsoft.com/en-us/azure/azure-monitor/log-query/functions

For example your function could be

Heartbeat | where Computer !in~ ("Computer1", "Computer2") | distinct Computer

If your function is called ExcludedComptuers when you do queries you can:

Perf
| where Computer !in~ (ExcludedComputers)

Mark this reply as answer if it was helpful.