Forum Discussion
Computer Groups with new query language?
Example:
Heartbeat | where Computer contains "SRV" | distinct Computer
You will create function out of this query and save with it with alias MyComputers for example. Than in a new query you can refer to it in this way for example:
Perf | where Computer in (MyComputers)
If it does not work right away in the Analytics Portal try refreshing it.
MicrosoftI was able to get this to work in my subscription:
Heartbeat | where Computer contains "<name>" | distinct Computer
I then saved the query, made a function of it, and used it to create a computer group.
Can you use that computer group in a query? That's the part that is failing for me.
Example:
Heartbeat | where Computer contains "SRV" | distinct Computer
You will create function out of this query and save with it with alias MyComputers for example. Than in a new query you can refer to it in this way for example:
Perf | where Computer in (MyComputers)
If it does not work right away in the Analytics Portal try refreshing it.
Hi Stanislav,
I have followed your example but I still can't get computer groups to work.
I have saved the search and can see the group under Computer Groups > Saved Groups but I am unable to reference the group in a search query. We had this working in the legacy log analytics but it didn't get converted during the log analytics upgrade.
- Perf type is with capital P so it will be Perf | where Computer in (MyComputers) The language is casesensitive. Let me know if that fixes it.
