How to join the 3 KQL tables?

kavya madda 60 Reputation points
2024-11-01T19:20:18.39+00:00

Hi all,

I want to get the inactive users data with seesionhostname, hostpoolname, lastlogindate,username

and i am trying to get it through KQL query which we need to join 3 tables

i am getting the below error

'join' operator: Failed to resolve column named '_ResourceId' Request id: 1f89431c-0f50-44cb-ba4d-48fc0010d07c

 while running the below queires

let RecentConnections =      WVDConnections     | where TimeGenerated > ago(30d)  // Replace with your parameter     | summarize lastLogin=max(TimeGenerated) by UserName, _ResourceId;

 

let InactiveUsers =      RecentConnections     | where lastLogin < ago(7d)  // Replace with your parameter     | project UserName, lastLogin, _ResourceId;

 

let InactiveComputers =      WVDHeartbeat     | where TimeGenerated > ago(30d)  // Replace with your parameter     | summarize LastActive = max(TimeGenerated) by Computer     | where LastActive < ago(7d)  // Replace with your parameter     | project LastActive, Computer;

 

// Combine inactive users with their last active computers InactiveUsers     | join kind=inner (InactiveComputers) on InactiveUsers._ResourceId == InactiveComputers.Computer     | project UserName, lastLogin, LastActive, _ResourceId;

 

please let me know how can i resolve it

it should have generate all details with 100% accuracy & should also work in log analytics workspace

Thanks in Advance

Azure Monitor
Azure Monitor
An Azure service that is used to collect, analyze, and act on telemetry data from Azure and on-premises environments.
3,308 questions
{count} votes

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.