Forum Discussion
mm83RI
May 25, 2023Copper Contributor
Exchange not showing in query results
Hi guys.
So I'm using this query
// Office activity for user
// The query presents user's activity over Office.
// Replace the UPN in the query with the UPN of the user of interest
let v_Users_UPN= "UserId";
OfficeActivity
| where UserId==v_Users_UPN
| where TimeGenerated between (datetime(2023-05-24) ..1d)
| project OfficeWorkload, Operation, ResultStatus, OfficeObjectId, _ResourceId, TimeGenerated, Application
| summarize by OfficeWorkload, TimeGenerated
| summarize min(TimeGenerated), max(TimeGenerated) by OfficeWorkload
| extend FirstActivity = datetime_utc_to_local( min_TimeGenerated,'CET')
| extend LastActivity = datetime_utc_to_local(max_TimeGenerated,'CET')
| project OfficeWorkload, FirstActivity, LastActivity, v_Users_UPN
And I can't figure out why I only get results for Teams, SP and OD but not Exchange?
Does anyone have any idea why?
- Clive_WatsonBronze ContributorIf I comment out line 6, in my data I see Exchange - perhaps you dont have any Exchange in that time period?
- mm83RICopper Contributor
I tried that but that confuses me the most because at that time nobody works
and when I don't remove it, time of the activity is exact
Do you know what is the issue here?