KQL Search

Query Details

Acrossworkspacefor Function

Query

union Update, workspace("contosoretail-it").Update, workspace("b459b4u5-912x-46d5-9cb1-p43069212nb4").Update
| where TimeGenerated >= ago(1h)
| where UpdateState == "Needed"
| summarize dcount(Computer) by Classification

Explanation

This query combines data from three different sources and filters it based on certain conditions. It then calculates the distinct count of computers for each classification.

Details

Rod Trent

Released: March 26, 2020

Tables

Update

Keywords

UnionUpdateWorkspaceTimeGeneratedAgoUpdateStateSummarizeDcountComputerClassification

Operators

unionworkspaceUpdatewhereTimeGeneratedago1hUpdateStatesummarizedcountComputerbyClassification

Actions

GitHub