Articles → MICROSOFT AZURE → Computer Groups In Azure Log Analytics

Computer Groups In Azure Log Analytics

In this article, we will discuss computer groups in Azure log analytics.

Purpose

Computer groups are used to set the scope of log queries to a particular set of computers.

Steps

For computer groups, we will work on the following steps: -

Create 3 virtual machines
Create a log analytic workspace
Create and save the query
Execute the query using computer groups

So, let’s get started.

Create 3 Virtual Machines

First, create 3 virtual machines.

Picture showing the virtual machines created in Azure portal

Click to Enlarge

Create A Log Analytic Workspace

Second step is to create a log analytics workspace and connect the virtual machines with the log analytics workspace. You can follow this link.

Create And Save The Query

In the query window, write the following query: -

Heartbeat
| where Computer == "vm1" or Computer == "vm2"
| distinct  Computer

In the above query, we want to set the scope of the log query to "vm1" and "vm2" only. Next step is to save the query.

To save the query, click on "Save" → "Save as function".

Picture showing the Save as function option for saving the query as function

Click to Enlarge

A window will appear where you can enter the following information: -

Field	Value
Function name	vm12CG (or any custom name)
Legacy category	virtualmachines
Save as computer group	checked

Picture showing the Save as function section for saving query as function

Click to Enlarge

Click on the "Save" button to save the query as a function. You can see your saved function in the "Computer Groups" screen.

Picture showing the Computer Groups section in log analytics

Click to Enlarge

Execute The Query Using Computer Groups

In the query window, write the query again using the computer groups.

Heartbeat
| where Computer in (vm12CG)

This is the output of the above query.

Picture showing querying the log analytics using computer group

Click to Enlarge

Posted By -	Karan Gupta

Posted On -	Thursday, July 7, 2022

Query/Feedback

Your Email Id		**

Subject		*

Query/Feedback	Characters remaining 250	**