Filter null results

[Todd Harrison]

Hi,

I am working on a super simple query to pull MachineName and OSBuild versions.

I would like the query to only return machines where the value of OSBuild is not null.

Here is what I have tried so far:

MachineInfo

| where OSBuild != "$null"

| summarize by ComputerName, OSBuild

I have tried explicitly excluding "null", but it doesn't work.

I have also tried using a regular expression to search for any number:

MachineInfo

| where OSBuild contains "[0-9]*"

| summarize by ComputerName, OSBuild

This generates an error.

I know there is something obvious I am doing wrong. Just curious if anyone can shed some light on where I am going wrong?

[#2 · Accepted solution]

Try this

MachineInfo

| where isnotnull (OSBuild)

| summarize by ComputerName, OSBuild

I can’t test on the demo site, but using the same with the heartbeat schema gives the results you may be looking for.  There is another command, isempty or isnotempty that does similar for string data.

[#3]

@Travis Roberts Thank you for your reply! This did the trick.

I didn't come across "isnotnull" in my search for a solution, although I suspect it was staring me in the face.

Is part of the problem that I am dealing with a numerical field as opposed to a string?

I would eventually like to turn this into a statical query where it will group all the OS values together, then give me a count of each.