Fetch Log Source Names Using DQL Queries

[PedroDeodato]

Greetings!

Well, the post subject pretty much sums it put, but what I need is a DQL query to fetch the name of every log source present on a specific host disk.

So, for example, every log source on my environment that begins with "Disk:\Folder1\Folder2"

I have tried to do it but, as the query needed to access every log source to gather this information, the query cost was massive.

Is there any cost-efficient way of achieving this?

Thanks!

[radek_jasinski]

Hi @PedroDeodato 

It seems to me that DQL does not support any operator to directly find “all starting with”.
And it also does not allow grouping or collecting unique values in a single fetch logs query.

However, I might be wrong.

Radek

[imsingh · Accepted solution]

Hi there

There is a DQL function which can check if a field startsWith something. Take a look at the following example:

fetch logs
| filter startsWith(log.source,"C:\\Users" )

[radek_jasinski]

@imsingh Thanks for the example;)