Forum Discussion
Log analytics - Look up external source of data
For your query specifically it seems like this should work, assuming you have ingested using Custom Logs functioanlity data from Custom Logs into the table User4_CL.
//Assuming your table User4_CL has username as a column - or substitute with appropriate colum.
let users=Users4_CL | summarize makeset(username);
SecurityEvent| where SubjectUserName in (users) | project RawData)
Thanks Ketan, i was able to make it work, my query was slightly different.
let arr = (search "whitelistusers_CL" | project Name_s );
let foo = (tableName:string) { table(tableName) | project Name_s };let b = foo('whitelistusers_CL');
SecurityEvent
| where SubjectUserName in (b)Ok.
Q: What is the first let statement for ? let arr = (search "whitelistusers_CL" | project Name_s)
Doesn't seem to be used anywhere?
That first line was a mistake.
