Forum Discussion
KQL Date between range not working
Due to the 10,000 row limit within KQL, we are working with running scan for just specific time ranges. Query: IdentityLogonEvents | where LogonType == "Failed logon" and isnotempty(AccountN...
I have not tested your KQL but have you tried moving your Timestap to the top of you query?
So your data set is first created within the wanted time range and narrowed down based on the logonType.
IdentityLogonEvents
| where Timestamp between (datetime(2021-5-02)..datetime(2021-5-03))
| where LogonType == "Failed logon" and isnotempty(AccountName)
| project LogonTime = Timestamp, LogonType, Application, FailureReason, AccountName, AccountUpn, DeviceName, DestinationDeviceName
So your data set is first created within the wanted time range and narrowed down based on the logonType.
IdentityLogonEvents
| where Timestamp between (datetime(2021-5-02)..datetime(2021-5-03))
| where LogonType == "Failed logon" and isnotempty(AccountName)
| project LogonTime = Timestamp, LogonType, Application, FailureReason, AccountName, AccountUpn, DeviceName, DestinationDeviceName
Hey Louis, Looks like they are going to decide to run the query everyday until we can get PowerBI desktop setup on the VM.
Cheers,
Cheers,