How can I return results of a query that aren't in the results of another query? For example, I want to return the results that are returned from the first query and are not also in the second query: First…
I hope somebody can help me with a tricky Kusto query. I have the following dataset, which contains events raised by user, where events are represented with event code: datatable(CreatedDate:datetime, User:string, EventCode:string) [ datetime(4-22-2024 12:44:02.750 PM), "user1", "TS", datetime(4-23-2024 4:09:30.551…
I'm trying to ingest some Microsoft Flow API data into Azure Log Analytics. Goal is that a Power Automate send a JSON with the Flows details to Log Analytics. Here is the sample JSON : { "body": [ { "NAME":…
There are common ways to handle dup data as described Here But I'm looking for more options. Thanks I have tried the options from here https://learn.microsoft.com/en-us/azure/data-explorer/dealing-with-duplicates and was looking into unique hashed row approach or a policy which triggers the…
I've got a KQL query, and I want to strip out the last row of data. However, the number of rows returned is variable, so I can't use take (aka limit) because I don't know what number to pass it.…
Is it possible to write a Kusto query for memory/CPU usage as percent of max for an Azure Container App? In the table AppPerformanceCounters I can find data on the Private Bytes and % Processor Time. But this does not…
I have a mental block and can´t figure this one out. In Azure Application Insights I have this custom table. I am trying to create an index of actual work. The table has this "event" column where you can have…
I am currently working on an Alert Rule in Log Analytics which is supposed to look back for 90 days, calculate a confidencelimit over that time and then compare today's value with the limit. If today's value exceeds the statistic,…
I have this query to check the application version AppInventory_CL | extend AppVersion_s_Dyn = split(AppVersion_s, '.') | extend Versione = iif(toint(AppVersion_s_Dyn[0]) >= 5 and toint(AppVersion_s_Dyn[1]) >= 2 and toint(AppVersion_s_Dyn[2]) >= 7, 'OK', 'KO') But I need that also superior versions…
I have to check an application version I'd like to mark as compliant if the version is => of 116.x.x.x This i s my query AppInventory_CL | where AppName_s in ('Microsoft Edge') or '*' in ('Microsoft Edge') | summarize arg_max(TimeGenerated,…