topic Re: Create a DQL Query to fetch the names of log sources in DQL

Fetch Log Source Names Using DQL Queries

PedroDeodato — Thu, 18 Dec 2025 10:38:45 GMT

Greetings!

Well, the post subject pretty much sums it put, but what I need is a DQL query to fetch the name of every log source present on a specific host disk.

So, for example, every log source on my environment that begins with "Disk:\Folder1\Folder2"

I have tried to do it but, as the query needed to access every log source to gather this information, the query cost was massive.

Is there any cost-efficient way of achieving this?

Thanks!

Re: Create a DQL Query to fetch the names of log sources

radek_jasinski — Mon, 07 Jul 2025 09:10:26 GMT

Hi @PedroDeodato

It seems to me that DQL does not support any operator to directly find “all starting with”.
And it also does not allow grouping or collecting unique values in a single fetch logs query.

However, I might be wrong.

Radek

Re: Create a DQL Query to fetch the names of log sources

imsingh — Mon, 07 Jul 2025 09:42:23 GMT

Hi there

There is a DQL function which can check if a field startsWith something. Take a look at the following example:

fetch logs | filter startsWith(log.source,"C:\\Users" )

Re: Create a DQL Query to fetch the names of log sources

radek_jasinski — Mon, 07 Jul 2025 10:18:07 GMT

@imsingh Thanks for the example;)