Sum Count of 2 different custom fields

Hello, I would like to sum two custom fields I created for failed logins in linux. Each field extracts a user name based on similar events (2 separate events though) and then I want to have a c...

azure monitor

Query Language

Evgeny Ternovsky

Microsoft

Jan 29, 2018

Sean,

Sounds like a great opportunity to use the fairly recently-introduced coalesce() command! Try the following (or click here to open it in our demo environment):

datatable (Computer: string, FailedPasswordUName_CF: string, PAMUser_CF: string, count_: int)
[
"AZR02-blurryid", "", "j.doe", 3,
"AZR02-blurryid", "j.doe", "", 7,
"AZR02-blurryid", "", "root", 2208,
"AZR02-blurryid", "root", "", 6540
]
| extend commonUID = coalesce(FailedPasswordUName_CF, PAMUser_CF)
| summarize sum(count_) by commonUID

Hope that works!

-Evgeny

pho30

Copper Contributor

Jan 29, 2018

Exactly what I needed, worked perfectly. Thank you!

Forum Discussion

Sum Count of 2 different custom fields