Computers Still Missing Updates (let) syntax error

%3CLINGO-SUB%20id%3D%22lingo-sub-870168%22%20slang%3D%22en-US%22%3EComputers%20Still%20Missing%20Updates%20(let)%20syntax%20error%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-870168%22%20slang%3D%22en-US%22%3E%3CP%3EThe%20following%20example%20shows%20a%20list%20of%20Computers%20that%20were%20missing%20one%20or%20more%20critical%20updates%20a%20few%20days%20ago%20and%20are%20still%20missing%20updates.%3C%2FP%3E%3CPRE%3Elet%20ComputersMissingUpdates3DaysAgo%20%3D%20Update%0A%7C%20where%20TimeGenerated%20between%20(ago(3d)..ago(2d))%0A%7C%20where%20%20Classification%20%3D%3D%20%22Critical%20Updates%22%20and%20UpdateState%20!%3D%20%22Not%20needed%22%20and%20UpdateState%20!%3D%20%22NotNeeded%22%0A%7C%20summarize%20makeset(Computer)%3B%0A%0AUpdate%0A%7C%20where%20TimeGenerated%20%26gt%3B%20ago(1d)%0A%7C%20where%20%20Classification%20%3D%3D%20%22Critical%20Updates%22%20and%20UpdateState%20!%3D%20%22Not%20needed%22%20and%20UpdateState%20!%3D%20%22NotNeeded%22%0A%7C%20where%20Computer%20in%20(ComputersMissingUpdates3DaysAgo)%0A%7C%20summarize%20UniqueUpdatesCount%20%3D%20dcount(Product)%20by%20Computer%2C%20OSType%3C%2FPRE%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThe%20materialize%20let%20provides%20syntax%20error%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CDIV%20class%3D%22header-block%22%3E%3CSPAN%20class%3D%22ai-tip-tests-error-message%20ng-binding%22%3ESYNTAX%20ERROR%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%20class%3D%22details-block%20ng-binding%22%3ENo%20tabular%20expression%20statement%20found%20Request%20id%3A%2035a8748f-0304-4d6e-b43e-00fa6bebcfd8%3C%2FDIV%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-870168%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%20Log%20Analytics%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-870383%22%20slang%3D%22en-US%22%3ERe%3A%20Computers%20Still%20Missing%20Updates%20(let)%20syntax%20error%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-870383%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F413564%22%20target%3D%22_blank%22%3E%40sathiyanhaae%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fms.portal.azure.com%23%4072f988bf-86f1-41af-91ab-2d7cd011db47%2Fblade%2FMicrosoft_Azure_Monitoring_Logs%2FDemoLogsBlade%2FresourceId%2F%252FDemo%2Fsource%2FLogsBlade.AnalyticsShareLinkToQuery%2Fq%2FH4sIAAAAAAAAA8VRTUvDQBC9B%25252Fofxp6yIAXtUSJIBE9Woe0P2GaecTG7G3dnKRF%25252FvBuSKh7Uo5dhvt97Mx2Eam%25252F7JAjx3sRoXLvvWQvi%25252BlYP8ab1VNGUWRTvdHxGAO2MxR0cQs4yHSBHwFGpW1%25252BuWa1Wo3PJSn1NUN3pvPzJNFqMd1RVtKyDkRx38%25252Fq4JO14DraSDZ3lro0XcgCDf6xvpvKIFpO1Opg3kNUviJDypE5dLYrfdVzTyPuC%25252F4H2hHaiSiYf84%25252BvqO9q9868Jsw9tU9O8tu4GZ3yMXhOjSg6DJ8Q5%25252FSw3Q09ig%25252BImtudAQIAAA%25253D%25253D%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3EGo%20to%20Log%20Analytics%20and%20Run%20Query%3C%2FA%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CDIV%3E%0A%3CDIV%3E%3CSPAN%3E%7C%20%3C%2FSPAN%3E%3CSPAN%3Esummarize%3C%2FSPAN%3E%3CSPAN%3E%20make_set(Computer)%3B%3C%2FSPAN%3E%26nbsp%3B%20%26nbsp%3B%3C%2FDIV%3E%0A%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%0A%3CDIV%3E%3CSPAN%3ETry%20%3CSTRONG%3Emake_set%3C%2FSTRONG%3E%20this%20will%20scale%20more%20than%20%3CSTRONG%3Emakeset%3C%2FSTRONG%3E%20that%20tops%20out%20at%20128%20limit%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fkusto%2Fquery%2Fmakeset-aggfunction%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fkusto%2Fquery%2Fmakeset-aggfunction%3C%2FA%3E%3C%2FSPAN%3E%3C%2FDIV%3E%0A%3C%2FDIV%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-983170%22%20slang%3D%22en-US%22%3ERe%3A%20Computers%20Still%20Missing%20Updates%20(let)%20syntax%20error%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-983170%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F239477%22%20target%3D%22_blank%22%3E%40Clive%20Watson%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3ETQ%20it%20was%20a%20silly%20mistake.%20both%20the%20let%20statement%20is%20not%20clubbed%20to%20derive%20output.%20while%20i%20placed%20then%20without%20space%2C%20it%20provided%20output.%20no%20one%20noticed%20it%20even%20me.%20after%20some%20retries%20i%20found%20that.%3C%2FP%3E%3C%2FLINGO-BODY%3E
New Contributor

The following example shows a list of Computers that were missing one or more critical updates a few days ago and are still missing updates.

let ComputersMissingUpdates3DaysAgo = Update
| where TimeGenerated between (ago(3d)..ago(2d))
| where  Classification == "Critical Updates" and UpdateState != "Not needed" and UpdateState != "NotNeeded"
| summarize makeset(Computer);

Update
| where TimeGenerated > ago(1d)
| where  Classification == "Critical Updates" and UpdateState != "Not needed" and UpdateState != "NotNeeded"
| where Computer in (ComputersMissingUpdates3DaysAgo)
| summarize UniqueUpdatesCount = dcount(Product) by Computer, OSType

 

The materialize let provides syntax error

 

SYNTAX ERROR
No tabular expression statement found Request id: 35a8748f-0304-4d6e-b43e-00fa6bebcfd8
2 Replies

@sathiyanhaae 

 

Go to Log Analytics and Run Query

 

| summarize make_set(Computer);   
 
Try make_set this will scale more than makeset that tops out at 128 limit https://docs.microsoft.com/en-us/azure/kusto/query/makeset-aggfunction

 

 

@Clive Watson 

TQ it was a silly mistake. both the let statement is not clubbed to derive output. while i placed then without space, it provided output. no one noticed it even me. after some retries i found that.