🔥Pivot is probably one of the underutilized but very powerful #dataanalysis operator in #KQL
👉Like PivotTable in Excel it creates aggregated views on categorical data for analysis to spot any unusual patterns across multiple columns 🧵👇
Refer doc : docs.microsoft.com/en-us/azure/da…
👉Like PivotTable in Excel it creates aggregated views on categorical data for analysis to spot any unusual patterns across multiple columns 🧵👇
Refer doc : docs.microsoft.com/en-us/azure/da…
👀Simple example of Pivot View of Successful Logons tabular data
👉No of unique users logging per hour across LogonTypes. 👇
👉No of unique users logging per hour across LogonTypes. 👇
💪Now taking the power of pivot to next level.
🤔 Ever wanted to parse complex windows XML format but tired of manually parsing out individual columns per eventID.
😎Let`s see pivot in action parsing windows XML in EventData column dynamically with #KQL
cc @Cyb3rWard0g
🤔 Ever wanted to parse complex windows XML format but tired of manually parsing out individual columns per eventID.
😎Let`s see pivot in action parsing windows XML in EventData column dynamically with #KQL
cc @Cyb3rWard0g
📌Reference Queries :
👉github.com/Azure/Azure-Se…
👉github.com/ashwin-patil/b…
🙏Lastly always use pivot on smaller timeframes , when you already know the datasize and no of columns beforehand to avoid data explosion while creating pivot view and causing performance impact.
👉github.com/Azure/Azure-Se…
👉github.com/ashwin-patil/b…
🙏Lastly always use pivot on smaller timeframes , when you already know the datasize and no of columns beforehand to avoid data explosion while creating pivot view and causing performance impact.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
