Forum Discussion
Solved
'summarize' operator: Failed to resolve scalar expression named 'TimeGenerated'
Hi Everyone, I am struggling to define time within query for workbook. My kql is represent 10 deny action followed by 1 allow connection with same external source IP to private destination IP with i...
- You haven't used that Column before in the code above, so the last line doesn't know about it - maybe add to this line?
| summarize denycount = count() by DeviceAction, SourceIP, DestinationIP, TimeGenerated
You haven't used that Column before in the code above, so the last line doesn't know about it - maybe add to this line?
| summarize denycount = count() by DeviceAction, SourceIP, DestinationIP, TimeGenerated
| summarize denycount = count() by DeviceAction, SourceIP, DestinationIP, TimeGenerated
- Thanks Clive for ur response. It is not working in ur line i.e. it is running but data is not coming but its working in
| summarize allowcount = count() by DeviceAction, SourceIP, DestinationIP, TimeGenerated
