Parser changes
This commit is contained in:
Родитель
8ce74fe042
Коммит
934f17853e
|
@ -3,7 +3,7 @@
|
|||
// Function usually takes 10-15 minutes to activate. You can then use function alias from any other queries (e.g. ProofpointPOD | take 10).
|
||||
// Reference : Using functions in Azure monitor log queries : https://docs.microsoft.com/azure/azure-monitor/log-query/functions
|
||||
let ProofpointPOD_maillog_view = view () {
|
||||
ProofpointPOD_maillog_CL
|
||||
union ProofpointPOD_maillog_CL, maillog_CL
|
||||
| extend
|
||||
SmMsgid=column_ifexists('sm_msgid_g', ''),
|
||||
PpsCid=column_ifexists('pps_cid_s', ''),
|
||||
|
@ -69,7 +69,7 @@ let ProofpointPOD_maillog_view = view () {
|
|||
NetworkDuration
|
||||
};
|
||||
let ProofpointPOD_message_view = view () {
|
||||
ProofpointPOD_message_CL
|
||||
union ProofpointPOD_message_CL, message_CL
|
||||
| extend
|
||||
FilterModulesUrldefenseCountsNoRewriteIsLargeMsgPartSize=column_ifexists('filter_modules_urldefense_counts_noRewriteIsLargeMsgPartSize_d', ''),
|
||||
PpsVersion=column_ifexists('pps_version_s', ''),
|
||||
|
|
Загрузка…
Ссылка в новой задаче