Forum Discussion

mm83RI's avatar
mm83RI
Copper Contributor
May 25, 2023

Exchange not showing in query results

Hi guys.

So I'm using this query 

 

// Office activity for user 
// The query presents user's activity over Office. 
// Replace the UPN in the query with the UPN of the user of interest
let v_Users_UPN= "UserId";
OfficeActivity
| where UserId==v_Users_UPN 
| where TimeGenerated between (datetime(2023-05-24) ..1d)
| project OfficeWorkload, Operation, ResultStatus, OfficeObjectId, _ResourceId, TimeGenerated, Application
| summarize by OfficeWorkload, TimeGenerated
| summarize min(TimeGenerated), max(TimeGenerated) by OfficeWorkload
| extend FirstActivity = datetime_utc_to_local( min_TimeGenerated,'CET')
| extend LastActivity = datetime_utc_to_local(max_TimeGenerated,'CET') 
| project OfficeWorkload, FirstActivity, LastActivity, v_Users_UPN

 

 

And I can't figure out why I only get results for Teams, SP and OD but not Exchange? 

Does anyone have any idea why?

  • Clive_Watson's avatar
    Clive_Watson
    Bronze Contributor
    If I comment out line 6, in my data I see Exchange - perhaps you dont have any Exchange in that time period?
    • mm83RI's avatar
      mm83RI
      Copper Contributor

      Clive_Watson 

      I tried that but that confuses me the most because at that time nobody works

      and when I don't remove it, time of the activity is exact

       

      Do you know what is the issue here?

Resources