Forum Discussion

akshay250692's avatar
akshay250692
Brass Contributor
May 12, 2022
Solved

'summarize' operator: Failed to resolve scalar expression named 'TimeGenerated'

Hi Everyone, I am struggling to define time within query for workbook. My kql is represent 10 deny action followed by 1 allow connection with same external source IP to private destination IP with i...
  • Clive_Watson's avatar
    Clive_Watson
    May 13, 2022
    You haven't used that Column before in the code above, so the last line doesn't know about it - maybe add to this line?

    | summarize denycount = count() by DeviceAction, SourceIP, DestinationIP, TimeGenerated
Clive_Watson's avatar
Clive_Watson
Bronze Contributor
May 13, 2022
You haven't used that Column before in the code above, so the last line doesn't know about it - maybe add to this line?

| summarize denycount = count() by DeviceAction, SourceIP, DestinationIP, TimeGenerated
akshay250692's avatar
akshay250692
Brass Contributor
May 13, 2022
Thanks Clive for ur response. It is not working in ur line i.e. it is running but data is not coming but its working in
| summarize allowcount = count() by DeviceAction, SourceIP, DestinationIP, TimeGenerated