Issue with log analytics query - need to add multiple resource group names in the filter.

[Syed_Aman]

Hi Team,

I have written a Log analytics query to trigger alert for last heartbeat and that query i need restrict only to few resource groups.

Query:

Heartbeat
| where TimeGenerated > ago(1h)
| where SubscriptionId != ""

| where ResourceGroup == "AZ-RG-TST"

| summarize LastHeartbeat = arg_max(TimeGenerated, SubscriptionId, TenantId, ResourceGroup) by Computer
| where isnotempty(Computer)
| where LastHeartbeat < ago(10m)
| project TenantId, SubscriptionId, Computer, LastHeartbeat, ResourceGroup

Can you please help me to add multiple resource group names in the filter as i don't find that option.

[#2 · Accepted solution]

Hi @Syed_Aman 

You could change one line and provide a list?

| where ResourceGroup in ("AZ-RG-TST", "AZ-RG-?????", "AZ-RG-?????")

or

| where ResourceGroup startswith "AZ-RG"