Query Details
Operational Visualizefailed Device Deployments
Query
// Visualize failed Device Deployments
IntuneOperationalLogs
| extend OS = tostring(todynamic(Properties).Os)
| where OS == "Windows"
| extend DeviceId = tostring(todynamic(Properties).AADDeviceId)
| where Result == "Fail"
| join kind=leftouter IntuneDevices on DeviceId
| project TimeGenerated, DeviceId, DeviceName
| summarize TimeGenerated = max(TimeGenerated) by DeviceId, DeviceName
| summarize ["Number of devices that failed deployment"] = count() by DeviceId, DeviceName, TimeGenerated
| render timechart
with (
kind=unstacked,
ytitle="Device Count",
xtitle="Date",
title="Number of devices that failed deployment") Explanation
This query is designed to visualize the number of Windows device deployments that have failed. It pulls data from the IntuneOperationalLogs, specifically looking for instances where the operating system (OS) is Windows and the result is "Fail".
The query then joins this data with the IntuneDevices data, using the DeviceId as the common field. It projects or displays the time the data was generated, the DeviceId, and the DeviceName.
The query then summarizes the data, showing the most recent time data was generated for each device, and counts the number of devices that have failed deployment.
Finally, the query visualizes this data in a timechart, with the number of devices on the y-axis, the date on the x-axis, and the title of the chart being "Number of devices that failed deployment". The chart is unstacked, meaning each data series is displayed separately.
Details
Ugur Koc
Released: July 9, 2022
Tables
Keywords
Operators