Search code examples
kqlazure-monitoringazure-monitor-workbooks

KQL - Searching in lists/strings


I'm setting up an Azure workbook that allows VM's to be selected using a parameter that I have called virtual_machines. When I select multiple VM resources using this parameter, it behaves in a query as below (I'm just using :names)

print ('{virtual_machines:names}')

vm-test-01, vm-test-02

I'm now trying to use this in a query but I'm getting no results. I think it's struggling with the fact the values aren't quoted individually. For example, if I use it in my usual where clause I get no results.

| where Computer in ('{virtual_machines:names}')

The query returned no results.

Should I be using a different method to filter other than in or should I be manipulating my {virtual_machines:names} list somehow? I'm new to KQL and am a little confused by the data types I'm dealing with here in terms of lists, dictionaries etc...

Any pointers?

Thanks


Solution

  • Multi-value parameter

    Multi-value parameter

    print Computer = "vm_test_01"
    | where Computer in (dynamic([{virtual_machines_names}]))