Jan 17 2022 04:30 AM
[{"IPAddress":"10.14.14.16","SubnetPrefix":null,"AddressType":"Private"}] |
Jan 17 2022 07:47 AM
DeviceInfo
| where Timestamp > ago(30d)
| summarize arg_max(Timestamp, *) by DeviceId
| where OnboardingStatus == 'Can be onboarded'
| join kind=inner (DeviceNetworkInfo | distinct DeviceId, MacAddress, IPAddresses) on DeviceId
| mvexpand parse_json(IPAddresses)
| extend IP=IPAddresses.IPAddress
| project DeviceName, OnboardingStatus, OSPlatform,OSDistribution,OSVersion, MacAddress, IP
| sort by DeviceName asc
ok, I have found a way , but is there a way to remove the double DeviceName's ? Distinc does not work on IP