Query Details
Multiple L Aworkspaces
Query
union Update, workspace("1stLAWorkspace").Update, workspace("2ndLAWorkspace").Update
| where TimeGenerated >= ago(1h)
| where UpdateState == "Needed"
Explanation
This query combines data from three sources: "Update", "1stLAWorkspace.Update", and "2ndLAWorkspace.Update". It filters the results to only include updates that were generated within the last hour and have a state of "Needed".
Details
Rod Trent
Released: March 26, 2020
Tables
Update
Keywords
Union,Update,Workspace,TimeGenerated,Ago,UpdateState,Needed
Operators
unionUpdateworkspaceUpdateworkspaceUpdatewhereTimeGenerated>=agowhereUpdateState==