May 09 2019
08:01 AM
- last edited on
Apr 07 2022
05:46 PM
by
TechCommunityAP
May 09 2019
08:01 AM
- last edited on
Apr 07 2022
05:46 PM
by
TechCommunityAP
Hi Team,
I have written a Log analytics query to trigger alert for last heartbeat and that query i need restrict only to few resource groups.
Query:
Heartbeat
| where TimeGenerated > ago(1h)
| where SubscriptionId != ""
| summarize LastHeartbeat = arg_max(TimeGenerated, SubscriptionId, TenantId, ResourceGroup) by Computer
| where isnotempty(Computer)
| where LastHeartbeat < ago(10m)
| project TenantId, SubscriptionId, Computer, LastHeartbeat, ResourceGroup
Can you please help me to add multiple resource group names in the filter as i don't find that option.
May 09 2019 09:07 AM
SolutionHi @Syed_Aman
You could change one line and provide a list?
| where ResourceGroup in ("AZ-RG-TST", "AZ-RG-?????", "AZ-RG-?????")
or
| where ResourceGroup startswith "AZ-RG"
May 09 2019 09:07 AM
SolutionHi @Syed_Aman
You could change one line and provide a list?
| where ResourceGroup in ("AZ-RG-TST", "AZ-RG-?????", "AZ-RG-?????")
or
| where ResourceGroup startswith "AZ-RG"