Windows Update progress

%3CLINGO-SUB%20id%3D%22lingo-sub-184955%22%20slang%3D%22en-US%22%3EWindows%20Update%20progress%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-184955%22%20slang%3D%22en-US%22%3E%3CP%3EMaybe%20I%20am%20going%20about%20this%20the%20wrong%20way%2C%20hoping%20to%20get%20some%20help.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWhat%20we%20are%20trying%20to%20accomplish%3A%20Trying%20to%20create%20a%20time%20to%20track%20the%20deployment%20progress%20of%20each%20Windows%20Update%20release.%20So%20far%20I%20have%20the%20following%20two%20queries%20that%20are%20being%20utilized%20in%20a%20Donut%20MultiQuery%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E1.%20Query%20for%20machines%20on%20version%20966%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWaaSDeploymentStatus%20%7C%20where%20UpdateCategory%3D%3D%22Quality%22%20and%20TargetBuild%20%3D%3D%20%2215063.966%22%20and%20DetailedStatus%20%3D%3D%20%22Update%20successful%22%20%7C%20distinct%20Computer%20%7C%20count%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E2.%20Machines%20that%20are%20on%20a%20version%20prior%20to%20966%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CDIV%3E%3CDIV%3E%3CSPAN%3Elet%20Table1%20%3D%20WaaSDeploymentStatus%20%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3E%7C%20%3C%2FSPAN%3E%3CSPAN%3Ewhere%3C%2FSPAN%3E%3CSPAN%3E%20UpdateCategory%3D%3D%20%3C%2FSPAN%3E%3CSPAN%3E%22Quality%22%3C%2FSPAN%3E%20%3CSPAN%3Eand%3C%2FSPAN%3E%3CSPAN%3E%20OSVersion%20%3D%3D%20%3C%2FSPAN%3E%3CSPAN%3E%221703%22%3C%2FSPAN%3E%20%3CSPAN%3Eand%3C%2FSPAN%3E%3CSPAN%3E%20DetailedStatus%20%3D%3D%20%3C%2FSPAN%3E%3CSPAN%3E%22Update%20successful%22%3C%2FSPAN%3E%20%3CSPAN%3Eand%3C%2FSPAN%3E%3CSPAN%3E%20TargetBuild%20%3D%3D%20%3C%2FSPAN%3E%3CSPAN%3E%2215063.966%22%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3E%7C%20%3C%2FSPAN%3E%3CSPAN%3Edistinct%3C%2FSPAN%3E%3CSPAN%3EComputer%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3E%7C%20%3C%2FSPAN%3E%3CSPAN%3Ecount%3C%2FSPAN%3E%3CSPAN%3E%20as%20Count1%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3E%7C%20%3C%2FSPAN%3E%3CSPAN%3Eextend%3C%2FSPAN%3E%3CSPAN%3E%20dummy%3D%3C%2FSPAN%3E%3CSPAN%3E1%3C%2FSPAN%3E%3CSPAN%3E%20%3B%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3Elet%20Table2%20%3D%20WaaSDeploymentStatus%20%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3E%7C%20%3C%2FSPAN%3E%3CSPAN%3Ewhere%3C%2FSPAN%3E%3CSPAN%3E%20UpdateCategory%3D%3D%3C%2FSPAN%3E%3CSPAN%3E%22Quality%22%3C%2FSPAN%3E%20%3CSPAN%3Eand%3C%2FSPAN%3E%3CSPAN%3E%20OSVersion%20%3D%3D%20%3C%2FSPAN%3E%3CSPAN%3E%221703%22%3C%2FSPAN%3E%20%3CSPAN%3Eand%3C%2FSPAN%3E%3CSPAN%3E%20DeploymentStatus%20%3D%3D%20%3C%2FSPAN%3E%3CSPAN%3E%22Update%20successful%22%3C%2FSPAN%3E%20%3CSPAN%3Eand%3C%2FSPAN%3E%3CSPAN%3E%20TargetBuild%20in%20(%3C%2FSPAN%3E%3CSPAN%3E%2215063.138%22%3C%2FSPAN%3E%3CSPAN%3E%2C%20%3C%2FSPAN%3E%3CSPAN%3E%2215063.250%22%3C%2FSPAN%3E%3CSPAN%3E%2C%20%3C%2FSPAN%3E%3CSPAN%3E%2215063.296%22%3C%2FSPAN%3E%3CSPAN%3E%2C%20%3C%2FSPAN%3E%3CSPAN%3E%2215063.332%22%3C%2FSPAN%3E%3CSPAN%3E%2C%20%3C%2FSPAN%3E%3CSPAN%3E%2215063.413%22%3C%2FSPAN%3E%3CSPAN%3E%2C%20%3C%2FSPAN%3E%3CSPAN%3E%2215063.447%22%3C%2FSPAN%3E%3CSPAN%3E%2C%20%3C%2FSPAN%3E%3CSPAN%3E%2215063.483%22%3C%2FSPAN%3E%3CSPAN%3E%2C%20%3C%2FSPAN%3E%3CSPAN%3E%2215063.502%22%3C%2FSPAN%3E%3CSPAN%3E%2C%20%3C%2FSPAN%3E%3CSPAN%3E%2215063.540%22%3C%2FSPAN%3E%3CSPAN%3E%2C%20%3C%2FSPAN%3E%3CSPAN%3E%2215063.608%22%3C%2FSPAN%3E%3CSPAN%3E%2C%20%3C%2FSPAN%3E%3CSPAN%3E%2215063.532%22%3C%2FSPAN%3E%3CSPAN%3E%2C%20%3C%2FSPAN%3E%3CSPAN%3E%2215063.674%22%3C%2FSPAN%3E%3CSPAN%3E%2C%20%3C%2FSPAN%3E%3CSPAN%3E%2215063.675%22%3C%2FSPAN%3E%3CSPAN%3E%2C%20%3C%2FSPAN%3E%3CSPAN%3E%2215063.726%22%3C%2FSPAN%3E%3CSPAN%3E%2C%20%3C%2FSPAN%3E%3CSPAN%3E%2215063.729%22%3C%2FSPAN%3E%3CSPAN%3E%2C%20%3C%2FSPAN%3E%3CSPAN%3E%2215063.786%22%3C%2FSPAN%3E%3CSPAN%3E%2C%20%3C%2FSPAN%3E%3CSPAN%3E%2215063.850%22%3C%2FSPAN%3E%3CSPAN%3E%2C%20%3C%2FSPAN%3E%3CSPAN%3E%2215063.877%22%3C%2FSPAN%3E%3CSPAN%3E%2C%20%3C%2FSPAN%3E%3CSPAN%3E%2215063.909%22%3C%2FSPAN%3E%3CSPAN%3E%2C%20%3C%2FSPAN%3E%3CSPAN%3E%2215063.936%22%3C%2FSPAN%3E%3CSPAN%3E%2C%20%3C%2FSPAN%3E%3CSPAN%3E%2215063.994%22%3C%2FSPAN%3E%3CSPAN%3E)%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3E%7C%20%3C%2FSPAN%3E%3CSPAN%3Edistinct%3C%2FSPAN%3E%3CSPAN%3EComputer%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3E%7C%20%3C%2FSPAN%3E%3CSPAN%3Ecount%3C%2FSPAN%3E%3CSPAN%3E%20as%20Count2%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3E%7C%20%3C%2FSPAN%3E%3CSPAN%3Eextend%3C%2FSPAN%3E%3CSPAN%3E%20dummy%3D%3C%2FSPAN%3E%3CSPAN%3E1%3C%2FSPAN%3E%3CSPAN%3E%3B%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3ETable1%20%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3E%7C%20%3C%2FSPAN%3E%3CSPAN%3Ejoin%3C%2FSPAN%3E%3CSPAN%3E%20kind%3D%20inner%20(Table2%20)%20%3C%2FSPAN%3E%3CSPAN%3Eon%3C%2FSPAN%3E%3CSPAN%3E%20dummy%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3E%7C%20%3C%2FSPAN%3E%3CSPAN%3Eextend%3C%2FSPAN%3E%3CSPAN%3E%20FinalCount%20%3D%20Count1-Count2%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3E%7C%20%3C%2FSPAN%3E%3CSPAN%3Eproject%3C%2FSPAN%3E%3CSPAN%3E%20FinalCount%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3EThe%20numbers%20that%20I%20am%20receiving%20aren't%20valid.%20What%20am%20I%20missing%20here%3F%20Is%20there%20a%20better%20way%20to%20do%20this%3F%3C%2FSPAN%3E%3C%2FDIV%3E%3C%2FDIV%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-184955%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%20Log%20Analytics%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EQuery%20Language%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-185727%22%20slang%3D%22en-US%22%3ERe%3A%20Windows%20Update%20progress%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-185727%22%20slang%3D%22en-US%22%3E%3CP%3EYou%20may%20have%20a%20typo%20in%20your%20query%20if%20you%20are%20looking%20for%20version%20prior%20to%2015063.966%20as%20you%20have%3CU%3E%20%22994%22%3C%2FU%3E%20in%20your%20query%3C%2FP%3E%0A%3CDIV%3E%0A%3CDIV%3E%3CSPAN%3E.......%2215063.909%22%3C%2FSPAN%3E%3CSPAN%3E%2C%20%3C%2FSPAN%3E%3CSPAN%3E%2215063.936%22%3C%2FSPAN%3E%3CSPAN%3E%2C%20%3C%2FSPAN%3E%3CSPAN%3E%2215063.%3CU%3E994%3C%2FU%3E%22%3C%2FSPAN%3E%3CSPAN%3E)%3C%2FSPAN%3E%3C%2FDIV%3E%0A%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%0A%3CDIV%3E%3CSPAN%3EAlso%20you%20can%20use%20the%20%3CA%20href%3D%22https%3A%2F%2Fdocs.loganalytics.io%2Fdocs%2FqueryLanguage%2Fquery_language_parse_versionfunction%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3Eparse_version%3C%2FA%3E%20function%20i.e%3C%2FSPAN%3E%3C%2FDIV%3E%0A%3CDIV%3E%3CSPAN%3Ean%20%3CA%20href%3D%22https%3A%2F%2Fportal.loganalytics.io%2FDemo%3Fq%3DH4sIAAAAAAAAAwtPTAx2SS3Iya%252FMTc0rCS5JLCktVuDlqlFIrShJzUtRKFOwVShILCpOjS9LLSrOzM%252FTCEksSk8tcSrNzEnRBCksz0gtSsWjRsEGTVLJ0NTAzFjP0sxMSVMhEWgHHr12WPUqgS0uKMrPSk0uUSjTUUDSowAA77h1ltIAAAA%253D%26amp%3Btimespan%3DP1D%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3Eexample%3C%2FA%3E%3C%2FSPAN%3E%3C%2FDIV%3E%0A%3CDIV%3E%0A%3CDIV%3E%0A%3CDIV%3E%3CSPAN%3EWaaSDeploymentStatus%20%3C%2FSPAN%3E%3C%2FDIV%3E%0A%3CDIV%3E%3CSPAN%3E%7C%20%3C%2FSPAN%3E%3CSPAN%3Eextend%3C%2FSPAN%3E%3CSPAN%3E%20v%20%3D%20parse_version(TargetBuild)%3C%2FSPAN%3E%3C%2FDIV%3E%0A%3CDIV%3E%3CSPAN%3E%7C%20%3C%2FSPAN%3E%3CSPAN%3Ewhere%3C%2FSPAN%3E%3CSPAN%3E%20parse_version(TargetBuild)%20%26lt%3B%20parse_version(%3C%2FSPAN%3E%3CSPAN%3E%2215063.966%22%3C%2FSPAN%3E%3CSPAN%3E)%20%3C%2FSPAN%3E%3CSPAN%3Eand%3C%2FSPAN%3E%3CSPAN%3E%20parse_version(TargetBuild)%20%26gt%3B%20parse_version(%3C%2FSPAN%3E%3CSPAN%3E%2215063%22%3C%2FSPAN%3E%3CSPAN%3E)%3C%2FSPAN%3E%3C%2FDIV%3E%0A%3CDIV%3E%3CSPAN%3E%7C%20%3C%2FSPAN%3E%3CSPAN%3Eproject%3C%2FSPAN%3E%3CSPAN%3E%20v%2C%20TargetBuild%3C%2FSPAN%3E%3C%2FDIV%3E%0A%3C%2FDIV%3E%0A%3C%2FDIV%3E%0A%3C%2FDIV%3E%3C%2FLINGO-BODY%3E
Occasional Contributor

Maybe I am going about this the wrong way, hoping to get some help.

 

What we are trying to accomplish: Trying to create a time to track the deployment progress of each Windows Update release. So far I have the following two queries that are being utilized in a Donut MultiQuery:

 

1. Query for machines on version 966:

 

WaaSDeploymentStatus | where UpdateCategory=="Quality" and TargetBuild == "15063.966" and DetailedStatus == "Update successful" | distinct Computer | count 

 

2. Machines that are on a version prior to 966:

 

let Table1 = WaaSDeploymentStatus
| where UpdateCategory== "Quality" and OSVersion == "1703" and DetailedStatus == "Update successful" and TargetBuild == "15063.966"
| distinct Computer
| count as Count1
| extend dummy=1 ;
let Table2 = WaaSDeploymentStatus
| where UpdateCategory=="Quality" and OSVersion == "1703" and DeploymentStatus == "Update successful" and TargetBuild in ("15063.138", "15063.250", "15063.296", "15063.332", "15063.413", "15063.447", "15063.483", "15063.502", "15063.540", "15063.608", "15063.532", "15063.674", "15063.675", "15063.726", "15063.729", "15063.786", "15063.850", "15063.877", "15063.909", "15063.936", "15063.994")
| distinct Computer
| count as Count2
| extend dummy=1;
Table1
| join kind= inner (Table2 ) on dummy
| extend FinalCount = Count1-Count2
| project FinalCount
 
The numbers that I am receiving aren't valid. What am I missing here? Is there a better way to do this?
1 Reply

You may have a typo in your query if you are looking for version prior to 15063.966 as you have "994" in your query

......."15063.909", "15063.936", "15063.994")
 
Also you can use the parse_version function i.e
WaaSDeploymentStatus
| extend v = parse_version(TargetBuild)
| where parse_version(TargetBuild) < parse_version("15063.966") and parse_version(TargetBuild) > parse_version("15063")
| project v, TargetBuild