OMS Syntax post series: #2 Computers

  • Article

Part 2 of the OMS Syntax series

 

Just a list of distinct computers in the OMS workspace (just returns the count and name rather than all the other details)

Computer=* | Distinct Computer

A similar list to the above but shows the computers sorted by aggregated value (i.e. sorted by  computers that have the most data)

Computer=* | measure count () by Computer

Remember that OMS Query Language (OQL) is case sensitive, so this will find a Computer called OM2016

Computer=om*

but this example wouldn't find that machine : Computer=Om*

This also works:

Computer=o*2016*

As does a Regular Expression, see more on RegEx here:  https://docs.microsoft.com/en-us/azure/log-analytics/log-analytics-log-searches-regex 

Computer=RegEx("@2016.myworkspace.co.uk")