Nov 06 2022 08:55 AM
I have been beating my head on this. I have been trying to project just the columns I need from a table and a watchlist, for example:
DeviceInfo
| where DeviceName == "dc1.lab.com"
| lookup kindinner _GetWatchlist('Device_Name')
on $left.host_s == right.SearchKey
From here I would like to project columns from the DeviceInfo table and the Watchlist table, but it does not populate the columns from the watchlist only from the column. Can anyone point me in the right direction?
Nov 07 2022 07:57 AM
Nov 07 2022 08:05 AM