KQL Search

Query Details

HomeAI ToolsDevice Query

Acrossworkspacefor Function

Query

union Update, workspace("contosoretail-it").Update, workspace("b459b4u5-912x-46d5-9cb1-p43069212nb4").Update
| where TimeGenerated >= ago(1h)
| where UpdateState == "Needed"
| summarize dcount(Computer) by Classification

Explanation

This query combines data from three different sources and filters it based on certain conditions. It then calculates the distinct count of computers for each classification.

Details

Rod Trent profile picture

Rod Trent

Released: March 26, 2020

Tables

Update

Keywords

Union,Update,Workspace,TimeGenerated,Ago,UpdateState,Summarize,Dcount,Computer,Classification

Operators

unionworkspaceUpdatewhereTimeGeneratedago1hUpdateStatesummarizedcountComputerbyClassification

Actions