Sorry, this is quite hard to visualize, without seeing your example. Are you using, something like this KQL (not sure where the hostname is coming from in this data though). AADServicePrincipalSignInLogs | summarize Events=count() by ServicePrincipalName, bin(TimeGenerated, 1d) Is this som...
union*// Get the Workspace Name(s) from a parameter|extend stringtoSplit=split("{WorkspaceIDguid}",",")|mv-expand stringtoSplit|where stringtoSplit has TenantId|extend workSpacename=trim(@"[^\w]+",tostring(split(stringtoSplit,":").[1]))// end of get ...
}else{// only name given, get cookievarcookieValue=null;if(document.cookie&&document.cookie!='') {varcookies=document.cookie.split(';');for(vari=0; i<cookies.length; i++) {varcookie=jQuery.trim(cookies[i]);// Does this cookie string begin with the name we want?if(cookie.substring(...
One idea let a=datatable(Hostname:string,Events:int)['GGPC-01',5,'GGPC-02',12,'JEPC-01',50,'JEPC-02',20];a|summarize JerseyPCs=sumif(Events,Hostname startswith"JE"),GuernseyPCs=sumif(Events,Hostname startswith"GG")|evaluatenarrow()|project-away Row|project-rename GroupedHostname=...
","body@stringLength":"227","rawBody":"Just trim it down, and add your Table name<enter name of table here>| summarize JerseyPCs = sumif(Events, Hostname startswith \"JE\"),GuernseyPCs = sumif(Events, Hostname startswith \"GG\")","kudosSumWeight":0,"repliesCount":3,"postTime...
Morning all, I have data where there are 20-30 distinct values, and I want to group the data into a smaller number of groups. As an example: Hostname Events GGPC-01 5 GGPC-02 12 JEPC-01 50 JEPC-02 20 I want to associate all hostnames starting with GG to the value "Guernsey ...
union*// Get the Workspace Name(s) from a parameter|extend stringtoSplit=split("{WorkspaceIDguid}",",")|mv-expand stringtoSplit|where stringtoSplit has TenantId|extend workSpacename=trim(@"[^\w]+",tostring(split(stringtoSplit,":").[1]))// end of get workspace nam...
union*// Get the Workspace Name(s) from a parameter|extend stringtoSplit=split("{WorkspaceIDguid}",",")|mv-expand stringtoSplit|where stringtoSplit has TenantId|extend workSpacename=trim(@"[^\w]+",tostring(split(stringtoSplit,":").[1]))// end of ge...
union*// Get the Workspace Name(s) from a parameter|extend stringtoSplit=split("{WorkspaceIDguid}",",")|mv-expand stringtoSplit|where stringtoSplit has TenantId|extend workSpacename=trim(@"[^\w]+",tostring(split(stringtoSplit,":").[1]))// end of ge...
union*// Get the Workspace Name(s) from a parameter|extend stringtoSplit=split("{WorkspaceIDguid}",",")|mv-expand stringtoSplit|where stringtoSplit has TenantId|extend workSpacename=trim(@"[^\w]+",tostring(split(stringtoSplit,":").[1]))// end of get workspace ...