Update Compliance Query help

Iron Contributor

Hi, I'm trying to create a log analytics query for Update Compliance so that it only shows the latest deployment status (not the ones generated every day) for each update that is made available to my devices

Currently I'm using this to get all the events:

WaaSDeploymentStatus
| where UpdateCategory == "Quality" and UpdateReleasedDate > ago(10d)

 

So if someone knows how to change the query so it only shows the latest deployment status (not the ones generated every day) for each update that is made available to my devices, that would be much appreciated.

 

Thank you in advance and don't hesitate if you have any questions

1 Reply
I am not 100% sure I understand - but I think you want a count summarization, perhaps?

Maybe a query along these lines -

WaaSDeploymentStatus | where UpdateCategory == "Quality" | summarize count() by UpdateReleasedDate, DeploymentStatus, DetailedStatus | order by UpdateReleasedDate asc