User Profile
SuryaJ
MicrosoftJoined Feb 01, 2022
User Widgets
Recent Discussions
Re: Kusto Query for Network Security Group
venu15 Taking the reference of logs format from here - https://learn.microsoft.com/en-us/azure/network-watcher/network-watcher-nsg-flow-logging-overview#log-format There are 3 parameters in the logs that can help us check if the traffic was allowed or denied So, KQL query for this check will be like below: nsgLogs // | where sourceIP== '10.226.16.165' and destinationIP== '159.123.12.3' // If you need IP filter | extend trafficDecision = iif(TrafficDecision == 'A', 'Allowed', 'Denied') | project sourceIP, destinationIP, trafficDecisionRe: Is there a bug in the make-series function or am I usingit wrong ?
Frederik-Gheysels While the start of time is inclusive, end of time is non inclusive. You created make-series on Timestamp column which has min value of 2023-03-29T00:00:00 but in your KQL query, you used 2023-03-29T08:38:03.6817196Z. so 12 and 7841 will not be included in the output. Your second query is correct since it included time less than the min timestamp in your table and a little more than the max timestamp.Re: Trying to get the unique values of "newValue" and "oldValue" in AuditLogs using Kusto
The query I gave was just an example. You can translate this to your data. For Example, I used co1.displayname=="conditional" which you can replace with category == "policy". This is not a literal query but the structure should help with your case. 1. Use mv-expand on oldvalue and newvalue 2. Use make_set 3. Use set_differenceRe: Trying to get the unique values of "newValue" and "oldValue" in AuditLogs using Kusto
Hi mikey365 , Can you try this ? : let device_mappings = datatable(col1:dynamic) [dynamic({"displayName":"conditional","oldvalue":{"id":"123","Name":"Surya","dept":"maths"},"newvalue":{"id":"123","Name":"Surya","dept":"science"}})]; device_mappings | where col1.displayName=="conditional" | extend oldvalue=col1.oldvalue, newvalue=col1.newvalue | mv-expand oldvalue, newvalue // to explode old and new values to multiple records | summarize make_set(oldvalue), make_set(newvalue) // for use in set_difference | project newValues= set_difference(set_newvalue,set_oldvalue) // compares new and old values and gets the New/changed key value pair The output of this will be the changed value only:
