Query Language
250 Topicsquery multiple "contains"
Greetings Community, I'm trying to come up with a way to query for multiple computers, but I have different strings to search for. For example: Heartbeat | where TimeGenerated >= ago(1h) | where Computer contains 'ACOMPUTER1' | summarize max(TimeGenerated) by Computer I can run this query but I have to execute it for a different string each time: Heartbeat | where TimeGenerated >= ago(1h) | where Computer contains 'ACOMPUTER1' | summarize max(TimeGenerated) by Computer Heartbeat | where TimeGenerated >= ago(1h) | where Computer contains 'SERVERABC' | summarize max(TimeGenerated) by Computer Heartbeat | where TimeGenerated >= ago(1h) | where Computer contains 'THISMACHINE_B' | summarize max(TimeGenerated) by Computer Is there a way to go through multiple "contains" or "has" statements in a single query? Was thinking that I'd have to build an array in a function or something... any help is appreciated.Solved111KViews0likes11CommentsRemove duplicates from query
Hi, hope somebody can help me as I'm a bit stuck in my understanding of the query language. So I'm trying to get some creation events for App Services, though there seems to be multiple entries for the same App. Therefore I'm trying to find a way to remove duplicates on a column but retain the rest of the columns in the output / or a defined set of columns. Though after dodging distinct on a specific column only this is retained in the output. This is my query: AzureActivity | where OperationName == 'Delete website' and ActivityStatus == 'Succeeded' and ResourceProvider == 'Azure Web Sites' Though this produces two entires for the same deletion, so I tired this: AzureActivity | where OperationName == 'Delete website' and ActivityStatus == 'Succeeded' and ResourceProvider == 'Azure Web Sites' | distinct CorrelationId Though this only leaves the CorrelationId in the output but I need the Resource, ResourceID,OperationName also to be shown in the output. Any tips on how to get the syntax correct? ThanksSolved104KViews1like11CommentsHelp with Disk query in Log Analytics
Hi I was wondering if I could get some help with Log analytics. New to this so bear with me. I'm trying to create a query that will provide informtaion on disk utilisation in Azure. I've gottwo commands (below), however I'm not able to merge them as I would like one query which gives me % free space, overall size of disk, name of vm and name of disk. Anything else I can get in terms of disk usage would be great, not overly concerned with IOPs at the moment. The commands are: Thsi proivides info on free space: search ObjectName == "LogicalDisk" and CounterName == "% Free Space" This one provides information on free Mb remaining. search ObjectName == "LogicalDisk" and CounterName == "Free Megabytes" I have tried this which helps, but again information is quite limited search ObjectName == "LogicalDisk" and CounterName == "Free Megabytes" and TimeGenerated > ago(1d) | summarize FreeSpace = min(CounterValue) by Computer, InstanceName | where strlen(InstanceName) ==2 and InstanceName contains ":" Thanks in advance 🙂Solved58KViews0likes15CommentsGeolocation query from IP address
Hi, Any idea if that's possible (and if yes - how) to add resolving of IP address to geolocation and any other IP information in a query in Log Analytics? For example, part of the message body I have in custom log is IP address, I would like to add a column (e.g. - extend) that resolves this IP address to its location in the world. Alternatively, if there was an option to call a rest service during query, I could call something like ipstack, and receive the required information. An example of simple query: MyEvents | extend IPAddress = extractjson("$.request.ipaddress", Message) | extend Country = extractgeo("$.country", IPAddress) Hopefully that was clear enough 🙂 Thanks! P.S. In PowerBI this can be achieved with Json.Document(Web.Contents("rest service url")....43KViews0likes25CommentsQuery for Average response time based on a sub set of the Azure Subscription
First time poster and very new to ALA... I have multiple sites within my Application insights resource and I want to get the Average Response time for each of the app/api's and then use them to create alerts if they go over our target SLA. Should I be using requests | search "https://nameofsite" to help seperate these and what query do I used to get this data? Many thanks,38KViews0likes1CommentUse time range value in kusto query to calculate % uptime
Is there a way to access time range selected from azure portal in log/app analytics query to help calculate the % uptime ? I am able to calculate the the downtime in minutes using our custom logic in the query , in order to calculate the % uptime , I need to know the variable/function which can give time range selected. Thanks, Abhijit35KViews1like8CommentsSchedule a query and mail the result?
hi out there I have a simple query for given security events in OMS which I want to run as a scheduled job and email me the result - daily - but sorry - I can't figure out how/where to do this from my Azure Log Analytics console - there must be a simple way - but how? The script I want to run at 08:00 every morning is simply like this: SecurityEvent | where ( EventID == 4728 ) | sort by AccountName and then mail me the outcome as a csv file - just like exporting it to csv...Solved30KViews1like6CommentsHeartbeat Azure Monitor OMS VMs
Hi all, i am trying to create an Alert for heartbeats if VM is didn't heartbeat in the last 15 min... here what i did and unfortunately it didnt fire alert. so i created a new alert rule in Azure Monitor (Alerts) the new one. i used the following query: Heartbeat | where TimeGenerated > ago(1d) | summarize max(TimeGenerated) by Computer | where max_TimeGenerated < ago(15m) this result if the VM didnt send any heartbeat for the last 15 mins. i set the alert logic to be on (Number of results Greater than 0) Evaluated based on the Period 15 mins and Frequency 5 mins. i stopped the agent and the results of the query indeed was more than 0 but the monitor didnt trigger , does any one have a working example for Alerting on heartbeats, Thanks.Solved27KViews1like5CommentsQuery to use percentage of values
Hello guys, I'm beginner in Azure and I started a project in Azure Log Analytics. I sent different values in a Custom Log from a Logic App (HTTP Request). I have two values "cpu_used" and "cpu_limit" (Number type) and I want to create a query like : Display when "cpu_used" is at 80% of "cpu_limit". I tried many possibilities but I don't understand how to make this. I don't understand anyway how to works summary percentile(). The value doesn't change. Thanks you in advance for your advises Regards,Solved24KViews0likes2Comments