SOLVED
Home

OMS queries update error

%3CLINGO-SUB%20id%3D%22lingo-sub-633009%22%20slang%3D%22en-US%22%3EOMS%20queries%20update%20error%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-633009%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20Guys%2C%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI'm%20facing%20error%20for%20this%20query%20appreciate%20it%20if%20anyone%20can%20help%20me%20with%20it%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CEM%3EProtectionStatus%20%7C%20summarize%20(TimeGenerated%2C%20Rank)%20%3D%20argmax(TimeGenerated%2C%20ThreatStatusRank)%20by%20Computer%20%7C%20where%20ThreatStatusRank%20%26gt%3B%20199%20and%20ThreatStatusRank%20!%3D%20470%26nbsp%3B%3C%2FEM%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Ethis%20throws%20me%20syntax%20error%20when%20I%20try%20to%20run%20it%20I%20have%20all%20the%20solutions%20created%20which%20are%20required%20for%20it.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-633009%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%20Log%20Analytics%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-633102%22%20slang%3D%22en-US%22%3ERe%3A%20OMS%20queries%20update%20error%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-633102%22%20slang%3D%22en-US%22%3EThis%20works%3CBR%20%2F%3E%3CBR%20%2F%3EProtectionStatus%3CBR%20%2F%3E%7C%20where%20ThreatStatusRank%20%26gt%3B%20199%20and%20ThreatStatusRank%20!%3D%20470%3CBR%20%2F%3E%7C%20summarize%20(TimeGenerated%2C%20Rank)%20%3D%20argmax(TimeGenerated%2C%20ThreatStatusRank)%20by%20Computer%3CBR%20%2F%3E%3CBR%20%2F%3E%3C%2FLINGO-BODY%3E
vicky2019
Occasional Contributor

Hi Guys, 

 

I'm facing error for this query appreciate it if anyone can help me with it

 

ProtectionStatus | summarize (TimeGenerated, Rank) = argmax(TimeGenerated, ThreatStatusRank) by Computer | where ThreatStatusRank > 199 and ThreatStatusRank != 470 

 

this throws me syntax error when I try to run it I have all the solutions created which are required for it.

1 Reply
Solution
This works

ProtectionStatus
| where ThreatStatusRank > 199 and ThreatStatusRank != 470
| summarize (TimeGenerated, Rank) = argmax(TimeGenerated, ThreatStatusRank) by Computer

Related Conversations
Extentions Synchronization
Deleted in Discussions on
3 Replies
Tabs and Dark Mode
cjc2112 in Discussions on
38 Replies
flashing a white screen while open new tab
Deleted in Discussions on
14 Replies
Stable version of Edge insider browser
HotCakeX in Discussions on
35 Replies
Security Community Webinars
Valon_Kolica in Security, Privacy & Compliance on
13 Replies