This commit is contained in:
ritika-msft 2021-12-03 20:48:33 +05:30
Родитель 8ce74fe042
Коммит 934f17853e
1 изменённых файлов: 2 добавлений и 2 удалений

Просмотреть файл

@ -3,7 +3,7 @@
// Function usually takes 10-15 minutes to activate. You can then use function alias from any other queries (e.g. ProofpointPOD | take 10).
// Reference : Using functions in Azure monitor log queries : https://docs.microsoft.com/azure/azure-monitor/log-query/functions
let ProofpointPOD_maillog_view = view () {
ProofpointPOD_maillog_CL
union ProofpointPOD_maillog_CL, maillog_CL
| extend
SmMsgid=column_ifexists('sm_msgid_g', ''),
PpsCid=column_ifexists('pps_cid_s', ''),
@ -69,7 +69,7 @@ let ProofpointPOD_maillog_view = view () {
NetworkDuration
};
let ProofpointPOD_message_view = view () {
ProofpointPOD_message_CL
union ProofpointPOD_message_CL, message_CL
| extend
FilterModulesUrldefenseCountsNoRewriteIsLargeMsgPartSize=column_ifexists('filter_modules_urldefense_counts_noRewriteIsLargeMsgPartSize_d', ''),
PpsVersion=column_ifexists('pps_version_s', ''),