I'm having an issue with the map rendering correct results. Is this correct?
SecurityIncident
// Get the Workspace Name(s) from a parameter
| extend stringtoSplit = split("{WorkspaceIDguid}",",")
| mvexpand stringtoSplit
| where stringtoSplit has TenantId
| extend workSpacename = trim(@"[^\w]+",tostring(split(stringtoSplit,":").[1]))
// end of get workspace name section
| extend Tactics_ = tostring(parsejson(tostring(AdditionalData.tactics)))
| summarize count()
by workSpacename, Tactics
| order by count_ desc
CliveW-MSFT
commented
3 years ago
I'm having an issue with the map rendering correct results. Is this correct?
SecurityIncident // Get the Workspace Name(s) from a parameter | extend stringtoSplit = split("{WorkspaceIDguid}",",") | mvexpand stringtoSplit | where stringtoSplit has TenantId | extend workSpacename = trim(@"[^\w]+",tostring(split(stringtoSplit,":").[1])) // end of get workspace name section | extend Tactics_ = tostring(parsejson(tostring(AdditionalData.tactics))) | summarize count() by workSpacename, Tactics | order by count_ desc