I am trying a build a query that can isolate results showing any device that is NOT running Windows 10 or above. So anything below this version AND excluding some OS platforms such as Servers, Android and iOS.
I have complied this, but was just wondering IF there is a more efficient way to build the FINAL where clause I have?
| where TimeGenerated > ago(1d)
| where isnotempty(OSPlatform)
| summarize arg_max(TimeGenerated, *) by DeviceName
| extend OSBuildString = tostring(OSBuild)
| where OSPlatform !contains "Windows1" and OSPlatform !contains "Server" and OSPlatform !contains "Linux" and OSPlatform !contains "Android" and OSPlatform != "iOS"
| project DeviceName, OSBuild, OSPlatform, OSVersion
| sort by OSPlatform asc