KQL query question

Copper Contributor

I have the following test query.

I'm wondering if I added (TimeGenerated 24h) correctly in lines number 5 and 12? Or is it enough to have it only in line 12? Similarly, in lines 6 and 13, do I need to add it twice? Or is it enough to have it only once in line 13?

Thank you



2 Replies
best response confirmed by CyberKing (Copper Contributor)


As I can't see the entire query, it's difficult to be 100% certain, but in union if you need to perform the same operations on different tables you can remove them from individual tables and add below, like so:



union kind=inner 
| distinct UserPrincipalName, TimeGenerated
| distinct UserId, TimeGenerated
| extend UserPrincipalName=UserId
| where UserPrincipalName contains 'adm'
| where TimeGenerated > ago(24h)



It certainly helps to keep the query more compact, but I'm not sure how this would affect the overall efficiency - in this case your union starts with 2 bigger tables and only trims them down afterwards.