Help with Union for two tables

%3CLINGO-SUB%20id%3D%22lingo-sub-1555857%22%20slang%3D%22en-US%22%3EHelp%20with%20Union%20for%20two%20tables%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1555857%22%20slang%3D%22en-US%22%3E%3CP%3EI%20have%20a%20basic%20malware%20count%20query%20as%20follows%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CPRE%20class%3D%22lia-code-sample%20language-applescript%22%3E%3CCODE%3EDeviceAlertEvents%20%0A%7C%20summarize%20count()%20by%20DeviceName%2C%20Title%2C%20FileName%2C%20Category%0A%7C%20sort%20by%20count_%3C%2FCODE%3E%3C%2FPRE%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHow%20can%20I%20use%20Union%20to%20pull%20the%20MachineGroup%20from%20the%20DeviceInfo%20table%20so%20I%20can%20see%20what%20MachineGroup%20each%20device%20is%20in%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThx%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1555857%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3Ekusto%20query%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E
Highlighted
Contributor

I have a basic malware count query as follows:

 

DeviceAlertEvents 
| summarize count() by DeviceName, Title, FileName, Category
| sort by count_

 

How can I use Union to pull the MachineGroup from the DeviceInfo table so I can see what MachineGroup each device is in?

 

Thx

0 Replies