May 09 2019
- last edited on
Apr 07 2022
I have written a Log analytics query to trigger alert for last heartbeat and that query i need restrict only to few resource groups.
| where TimeGenerated > ago(1h)
| where SubscriptionId != ""
| summarize LastHeartbeat = arg_max(TimeGenerated, SubscriptionId, TenantId, ResourceGroup) by Computer
| where isnotempty(Computer)
| where LastHeartbeat < ago(10m)
| project TenantId, SubscriptionId, Computer, LastHeartbeat, ResourceGroup
Can you please help me to add multiple resource group names in the filter as i don't find that option.
May 09 2019 09:07 AMSolution
You could change one line and provide a list?
| where ResourceGroup in ("AZ-RG-TST", "AZ-RG-?????", "AZ-RG-?????")
| where ResourceGroup startswith "AZ-RG"