Sorry, this is quite hard to visualize, without seeing your example. Are you using, something like this KQL (not sure where the hostname is coming from in this data though). AADServicePrincipalSignInLogs | summarize Events=count() by ServicePrincipalName, bin(TimeGenerated, 1d) Is this som...
union*// Get the Workspace Name(s) from a parameter|extend stringtoSplit=split("{WorkspaceIDguid}",",")|mv-expand stringtoSplit|where stringtoSplit has TenantId|extend workSpacename=trim(@"[^\w]+",tostring(split(stringtoSplit,":").[1]))// end of get ...
Is this something you can mock up in a datatable (like in my first example)? One idea let a=datatable(Hostname:string,Events:int)['GGPC-01',5,'GGPC-02',12,'JEPC-01',50,'JEPC-02',20];a|summarize JerseyPCs=sumif(Events,Hostname startswith"JE"),GuernseyPCs=sumif(Events,Hostnam...
Grouped Hostname Events Guernsey PCs 17 Jersey PCs 70 I'm sure this must have been done before (the reason I want to do this is for readability when the query's exported into PowerBI), but can't find a solution. Any pointers appreciated! KQL Cheers James Sorry, this is quite hard to...
{"__typename":"PageInfo","hasNextPage":false,"endCursor":null},"totalCount":1},"cachedText({\"lastModified\":\"1737115705000\",\"locale\":\"en-US\",\"namespaces\":[\"shared/client/components/users/UserAvatar\"]})":[{"__ref":"CachedAsset:text:en_US-shared/client/components/users...
union*// Get the Workspace Name(s) from a parameter|extend stringtoSplit=split("{WorkspaceIDguid}",",")|mv-expand stringtoSplit|where stringtoSplit has TenantId|extend workSpacename=trim(@"[^\w]+",tostring(split(stringtoSplit,":").[1]))// end of ge...
union*// Get the Workspace Name(s) from a parameter|extend stringtoSplit=split("{WorkspaceIDguid}",",")|mv-expand stringtoSplit|where stringtoSplit has TenantId|extend workSpacename=trim(@"[^\w]+",tostring(split(stringtoSplit,":").[1]))// end of ge...
union*// Get the Workspace Name(s) from a parameter|extend stringtoSplit=split("{WorkspaceIDguid}",",")|mv-expand stringtoSplit|where stringtoSplit has TenantId|extend workSpacename=trim(@"[^\w]+",tostring(split(stringtoSplit,":").[1]))// end of get workspace nam...
union*// Get the Workspace Name(s) from a parameter|extend stringtoSplit=split("{WorkspaceIDguid}",",")|mv-expand stringtoSplit|where stringtoSplit has TenantId|extend workSpacename=trim(@"[^\w]+",tostring(split(stringtoSplit,":").[1]))// end of get workspace ...