Is it possible to output 2 tables to then use in another join with a different query? For example say I have this let de1= DeviceNetworkEvents | where DeviceName contains "server1" | where ProcessId == "111"; let de2= DeviceNetworkEvents | where DeviceName contains "server1" | where ConnectionString == "Connection Successful"; de1 | union de2 by Something
Can I then take the combined output of this and use the details from this to then do another union with a different table?
@WillAda you can use the join operator. DeviceNetworkEvents | where DeviceName contains "server1" | join kind = inner ( DeviceNetworkEvents | where DeviceName contains "server1" ) on "something"
