Computers Still Missing Updates (let) syntax error

Copper Contributor

The following example shows a list of Computers that were missing one or more critical updates a few days ago and are still missing updates.

let ComputersMissingUpdates3DaysAgo = Update
| where TimeGenerated between (ago(3d)..ago(2d))
| where  Classification == "Critical Updates" and UpdateState != "Not needed" and UpdateState != "NotNeeded"
| summarize makeset(Computer);

Update
| where TimeGenerated > ago(1d)
| where  Classification == "Critical Updates" and UpdateState != "Not needed" and UpdateState != "NotNeeded"
| where Computer in (ComputersMissingUpdates3DaysAgo)
| summarize UniqueUpdatesCount = dcount(Product) by Computer, OSType

 

The materialize let provides syntax error

 

SYNTAX ERROR
No tabular expression statement found Request id: 35a8748f-0304-4d6e-b43e-00fa6bebcfd8
2 Replies

@sathiyanhaae 

 

Go to Log Analytics and Run Query

 

| summarize make_set(Computer);   
 
Try make_set this will scale more than makeset that tops out at 128 limit https://docs.microsoft.com/en-us/azure/kusto/query/makeset-aggfunction

 

 

@CliveWatson 

TQ it was a silly mistake. both the let statement is not clubbed to derive output. while i placed then without space, it provided output. no one noticed it even me. after some retries i found that.