Forum Discussion
Log Analytics Alert Filtered Query
I made this query: AzureDevOpsAuditing
| where ActorUPN != "Azure DevOps Service"
| where Area == "Release"
| summarize Count = count()
by
OperationName,
bin(TimeGenerated, 1440min),...
When you do line #12, you essential drop the other columns, so they are not available for any other lines after #12 to process.
One way is to union the results, it does mean you process the data twice, once to get the count and once for the sum. See this simple example, as a place to start.
union
(
Usage
| where DataType =="AzureActivity"
| summarize count() by DataType, IsBillable, Solution, Quantity
),
(
Usage
| where DataType =="AzureActivity"
| summarize count() by IsBillable, Solution, Quantity
| summarize Total = sum(count_), DataType="This is you Total"
)
