Reputation: 165
I'm trying to create Computer group for Update management from log analytics saved search but can't figure it totally out.
When using this query, it will list all computer that has "test" in their name. Working fine, but not exactly what I'm looking for.
Heartbeat
| where Computer contains "test"
| distinct Computer
But when I want to add computers by their specific name, I get error. Any this how can I get result by using computers specific names?
[
Heartbeat
| where Computer contains "test" and "test2" and "test3"
| distinct Computer
Also tried with "or" "has" "==" but could not get it working.
Upvotes: 1
Views: 642
Reputation: 29985
Please try the in operator.
Sample query looks like below:
Heartbeat
| where Computer in ("test", "test2", "test3")
| distinct Computer
Upvotes: 1