Aug 01 2023 04:48 AM
I have the following test query.
I'm wondering if I added (TimeGenerated 24h) correctly in lines number 5 and 12? Or is it enough to have it only in line 12? Similarly, in lines 6 and 13, do I need to add it twice? Or is it enough to have it only once in line 13?
Thank you
Aug 01 2023 08:52 AM - edited Aug 01 2023 08:53 AM
SolutionAs I can't see the entire query, it's difficult to be 100% certain, but in union if you need to perform the same operations on different tables you can remove them from individual tables and add below, like so:
union kind=inner
(SigninLogs
| distinct UserPrincipalName, TimeGenerated
),
(OfficeActivity
| distinct UserId, TimeGenerated
| extend UserPrincipalName=UserId
)
| where UserPrincipalName contains 'adm'
| where TimeGenerated > ago(24h)
It certainly helps to keep the query more compact, but I'm not sure how this would affect the overall efficiency - in this case your union starts with 2 bigger tables and only trims them down afterwards.
Aug 01 2023 08:52 AM - edited Aug 01 2023 08:53 AM
SolutionAs I can't see the entire query, it's difficult to be 100% certain, but in union if you need to perform the same operations on different tables you can remove them from individual tables and add below, like so:
union kind=inner
(SigninLogs
| distinct UserPrincipalName, TimeGenerated
),
(OfficeActivity
| distinct UserId, TimeGenerated
| extend UserPrincipalName=UserId
)
| where UserPrincipalName contains 'adm'
| where TimeGenerated > ago(24h)
It certainly helps to keep the query more compact, but I'm not sure how this would affect the overall efficiency - in this case your union starts with 2 bigger tables and only trims them down afterwards.