SOLVED

OMS queries update error

Copper Contributor

Hi Guys, 

 

I'm facing error for this query appreciate it if anyone can help me with it

 

ProtectionStatus | summarize (TimeGenerated, Rank) = argmax(TimeGenerated, ThreatStatusRank) by Computer | where ThreatStatusRank > 199 and ThreatStatusRank != 470 

 

this throws me syntax error when I try to run it I have all the solutions created which are required for it.

1 Reply
best response confirmed by vicky2019 (Copper Contributor)
Solution
This works

ProtectionStatus
| where ThreatStatusRank > 199 and ThreatStatusRank != 470
| summarize (TimeGenerated, Rank) = argmax(TimeGenerated, ThreatStatusRank) by Computer

1 best response

Accepted Solutions
best response confirmed by vicky2019 (Copper Contributor)
Solution
This works

ProtectionStatus
| where ThreatStatusRank > 199 and ThreatStatusRank != 470
| summarize (TimeGenerated, Rank) = argmax(TimeGenerated, ThreatStatusRank) by Computer

View solution in original post