Not sure if its fluke but when running CMPivot with the following
WinEvent('Security',1d) | where ID == 6422 | project Device, Message | distinct Device
spawned two or three PowerShell scripts. In addition the query consumes a large of CPU. Has anyone tried this against the security log?
I can run the same item in PowerShell ISE and its considerably faster.
Not sure if its fluke but when running CMPivot with the following WinEvent('Security',1d) | where ID == 6422 | project Device, Message | distinct Device
spawned two or three PowerShell scripts. In addition the query consumes a large of CPU. Has anyone tried this against the security log? I can run the same item in PowerShell ISE and its considerably faster.