Forum Discussion
vicky2019
May 22, 2019Copper Contributor
OMS queries update error
Hi Guys,
I'm facing error for this query appreciate it if anyone can help me with it
ProtectionStatus | summarize (TimeGenerated, Rank) = argmax(TimeGenerated, ThreatStatusRank) by Computer | where ThreatStatusRank > 199 and ThreatStatusRank != 470
this throws me syntax error when I try to run it I have all the solutions created which are required for it.
- This works
ProtectionStatus
| where ThreatStatusRank > 199 and ThreatStatusRank != 470
| summarize (TimeGenerated, Rank) = argmax(TimeGenerated, ThreatStatusRank) by Computer
- CliveWatson
Microsoft
This works
ProtectionStatus
| where ThreatStatusRank > 199 and ThreatStatusRank != 470
| summarize (TimeGenerated, Rank) = argmax(TimeGenerated, ThreatStatusRank) by Computer