diff --git a/Parsers/ProofpointPOD/ProofpointPOD b/Parsers/ProofpointPOD/ProofpointPOD index 00b7d7f91b..00d43d0855 100644 --- a/Parsers/ProofpointPOD/ProofpointPOD +++ b/Parsers/ProofpointPOD/ProofpointPOD @@ -3,7 +3,7 @@ // Function usually takes 10-15 minutes to activate. You can then use function alias from any other queries (e.g. ProofpointPOD | take 10). // Reference : Using functions in Azure monitor log queries : https://docs.microsoft.com/azure/azure-monitor/log-query/functions let ProofpointPOD_maillog_view = view () { - ProofpointPOD_maillog_CL + union ProofpointPOD_maillog_CL, maillog_CL | extend SmMsgid=column_ifexists('sm_msgid_g', ''), PpsCid=column_ifexists('pps_cid_s', ''), @@ -69,7 +69,7 @@ let ProofpointPOD_maillog_view = view () { NetworkDuration }; let ProofpointPOD_message_view = view () { - ProofpointPOD_message_CL + union ProofpointPOD_message_CL, message_CL | extend FilterModulesUrldefenseCountsNoRewriteIsLargeMsgPartSize=column_ifexists('filter_modules_urldefense_counts_noRewriteIsLargeMsgPartSize_d', ''), PpsVersion=column_ifexists('pps_version_s', ''),