Forum Discussion

vicky2019's avatar
vicky2019
Copper Contributor
May 22, 2019

OMS queries update error

Hi Guys, 

 

I'm facing error for this query appreciate it if anyone can help me with it

 

ProtectionStatus | summarize (TimeGenerated, Rank) = argmax(TimeGenerated, ThreatStatusRank) by Computer | where ThreatStatusRank > 199 and ThreatStatusRank != 470 

 

this throws me syntax error when I try to run it I have all the solutions created which are required for it.

  • This works

    ProtectionStatus
    | where ThreatStatusRank > 199 and ThreatStatusRank != 470
    | summarize (TimeGenerated, Rank) = argmax(TimeGenerated, ThreatStatusRank) by Computer

  • This works

    ProtectionStatus
    | where ThreatStatusRank > 199 and ThreatStatusRank != 470
    | summarize (TimeGenerated, Rank) = argmax(TimeGenerated, ThreatStatusRank) by Computer

Resources