SOLVED

KQL query question

Copper Contributor

I have the following test query.

I'm wondering if I added (TimeGenerated 24h) correctly in lines number 5 and 12? Or is it enough to have it only in line 12? Similarly, in lines 6 and 13, do I need to add it twice? Or is it enough to have it only once in line 13?

Thank you

CyberKing_0-1690890430916.png

 

2 Replies
best response confirmed by CyberKing (Copper Contributor)
Solution

@CyberKing 

As I can't see the entire query, it's difficult to be 100% certain, but in union if you need to perform the same operations on different tables you can remove them from individual tables and add below, like so:

 

 

union kind=inner 
(SigninLogs
| distinct UserPrincipalName, TimeGenerated
),
(OfficeActivity
| distinct UserId, TimeGenerated
| extend UserPrincipalName=UserId
)
| where UserPrincipalName contains 'adm'
| where TimeGenerated > ago(24h)

 

 

It certainly helps to keep the query more compact, but I'm not sure how this would affect the overall efficiency - in this case your union starts with 2 bigger tables and only trims them down afterwards.

thanks!