<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Need help on Dax for KQL query in DAX Commands and Tips</title>
    <link>https://community.fabric.microsoft.com/t5/DAX-Commands-and-Tips/Need-help-on-Dax-for-KQL-query/m-p/1856543#M39720</link>
    <description>&lt;P&gt;can anybody provide SQL query for above kql queries?&lt;/P&gt;</description>
    <pubDate>Fri, 21 May 2021 09:32:52 GMT</pubDate>
    <dc:creator>rajutechstar</dc:creator>
    <dc:date>2021-05-21T09:32:52Z</dc:date>
    <item>
      <title>Need help on Dax for KQL query</title>
      <link>https://community.fabric.microsoft.com/t5/DAX-Commands-and-Tips/Need-help-on-Dax-for-KQL-query/m-p/1855552#M39696</link>
      <description>&lt;P&gt;Below is the KQL query, i need dax query in Power BI. Could you please provide me the DAX for below KQL queries&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;KQL1:&lt;/P&gt;&lt;P&gt;SecurityIncident&lt;BR /&gt;| where TimeGenerated &amp;gt; ago(100d)&lt;BR /&gt;| where FirstActivityTime &amp;lt;&amp;gt; ''&lt;BR /&gt;| where Status == 'New'&lt;BR /&gt;| summarize arg_min(TimeGenerated,*) by IncidentNumber&lt;BR /&gt;| extend TimeToTriage = (FirstModifiedTime - CreatedTime)/1s&lt;BR /&gt;| summarize min(TimeGenerated), FirstActivity=min(FirstActivityTime), Created=min(CreatedTime) by Title, ProviderIncidentId&lt;BR /&gt;| extend DetectTime = (Created - FirstActivity)/1m&lt;BR /&gt;| extend TileTitle = 'All'&lt;BR /&gt;| summarize MeanTime = percentile(DetectTime, 50) by TileTitle&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;KQL2:&lt;/P&gt;&lt;DIV&gt;&lt;DIV&gt;&lt;SPAN&gt;UniqueIncidents&lt;/SPAN&gt;&lt;/DIV&gt;&lt;DIV&gt;&lt;SPAN&gt;|&amp;nbsp;&lt;/SPAN&gt;&lt;SPAN&gt;where&lt;/SPAN&gt;&lt;SPAN&gt;&amp;nbsp;&lt;/SPAN&gt;&lt;SPAN&gt;StatusList&lt;/SPAN&gt;&lt;SPAN&gt;&amp;nbsp;&lt;/SPAN&gt;&lt;SPAN&gt;contains&lt;/SPAN&gt;&lt;SPAN&gt;&amp;nbsp;&lt;/SPAN&gt;&lt;SPAN&gt;"Closed"&lt;/SPAN&gt;&lt;/DIV&gt;&lt;DIV&gt;&lt;SPAN&gt;|&amp;nbsp;&lt;/SPAN&gt;&lt;SPAN&gt;summarize&lt;/SPAN&gt;&lt;SPAN&gt;&amp;nbsp;&lt;/SPAN&gt;&lt;SPAN&gt;Total&lt;/SPAN&gt;&lt;SPAN&gt;=&lt;/SPAN&gt;&lt;SPAN&gt;count&lt;/SPAN&gt;&lt;SPAN&gt;(),&lt;/SPAN&gt;&lt;SPAN&gt;TruePositive&lt;/SPAN&gt;&lt;SPAN&gt;=&lt;/SPAN&gt;&lt;SPAN&gt;count&lt;/SPAN&gt;&lt;SPAN&gt;if&lt;/SPAN&gt;&lt;SPAN&gt;(&lt;/SPAN&gt;&lt;SPAN&gt;Classificati&lt;/SPAN&gt;&lt;SPAN&gt;on&lt;/SPAN&gt;&lt;SPAN&gt;&amp;nbsp;==&amp;nbsp;&lt;/SPAN&gt;&lt;SPAN&gt;'TruePositive'&lt;/SPAN&gt;&lt;SPAN&gt;)&lt;/SPAN&gt;&lt;/DIV&gt;&lt;DIV&gt;&lt;SPAN&gt;|&amp;nbsp;&lt;/SPAN&gt;&lt;SPAN&gt;extend&lt;/SPAN&gt;&lt;SPAN&gt;&amp;nbsp;&lt;/SPAN&gt;&lt;SPAN&gt;Results&lt;/SPAN&gt;&lt;SPAN&gt;&amp;nbsp;=&amp;nbsp;&lt;/SPAN&gt;&lt;SPAN&gt;pack&lt;/SPAN&gt;&lt;SPAN&gt;(&lt;/SPAN&gt;&lt;SPAN&gt;"Total"&lt;/SPAN&gt;&lt;SPAN&gt;,&lt;/SPAN&gt;&lt;SPAN&gt;Total&lt;/SPAN&gt;&lt;SPAN&gt;,&lt;/SPAN&gt;&lt;SPAN&gt;"TruePositives"&lt;/SPAN&gt;&lt;SPAN&gt;,&lt;/SPAN&gt;&lt;SPAN&gt;TruePositive&lt;/SPAN&gt;&lt;SPAN&gt;)&lt;/SPAN&gt;&lt;/DIV&gt;&lt;DIV&gt;&lt;SPAN&gt;|&amp;nbsp;&lt;/SPAN&gt;&lt;SPAN&gt;project&lt;/SPAN&gt;&lt;SPAN&gt;&amp;nbsp;&lt;/SPAN&gt;&lt;SPAN&gt;Results&lt;/SPAN&gt;&lt;/DIV&gt;&lt;DIV&gt;&lt;SPAN&gt;|&amp;nbsp;&lt;/SPAN&gt;&lt;SPAN&gt;mv&lt;/SPAN&gt;&lt;SPAN&gt;-&lt;/SPAN&gt;&lt;SPAN&gt;exp&lt;/SPAN&gt;&lt;SPAN&gt;and&lt;/SPAN&gt;&lt;SPAN&gt;&amp;nbsp;&lt;/SPAN&gt;&lt;SPAN&gt;Results&lt;/SPAN&gt;&lt;/DIV&gt;&lt;DIV&gt;&lt;SPAN&gt;|&amp;nbsp;&lt;/SPAN&gt;&lt;SPAN&gt;extend&lt;/SPAN&gt;&lt;SPAN&gt;&amp;nbsp;&lt;/SPAN&gt;&lt;SPAN&gt;Title&lt;/SPAN&gt;&lt;SPAN&gt;&amp;nbsp;=&amp;nbsp;&lt;/SPAN&gt;&lt;SPAN&gt;iff&lt;/SPAN&gt;&lt;SPAN&gt;(&lt;/SPAN&gt;&lt;SPAN&gt;tostring&lt;/SPAN&gt;&lt;SPAN&gt;(&lt;/SPAN&gt;&lt;SPAN&gt;Results&lt;/SPAN&gt;&lt;SPAN&gt;.&lt;/SPAN&gt;&lt;SPAN&gt;Total&lt;/SPAN&gt;&lt;SPAN&gt;)&amp;lt;&amp;gt;&lt;/SPAN&gt;&lt;SPAN&gt;''&lt;/SPAN&gt;&lt;SPAN&gt;,&lt;/SPAN&gt;&lt;SPAN&gt;'Total'&lt;/SPAN&gt;&lt;SPAN&gt;,&lt;/SPAN&gt;&lt;SPAN&gt;'TruePositive'&lt;/SPAN&gt;&lt;SPAN&gt;)&lt;/SPAN&gt;&lt;/DIV&gt;&lt;DIV&gt;&lt;SPAN&gt;|&amp;nbsp;&lt;/SPAN&gt;&lt;SPAN&gt;extend&lt;/SPAN&gt;&lt;SPAN&gt;&amp;nbsp;&lt;/SPAN&gt;&lt;SPAN&gt;Count&lt;/SPAN&gt;&lt;SPAN&gt;&amp;nbsp;=&amp;nbsp;&lt;/SPAN&gt;&lt;SPAN&gt;iff&lt;/SPAN&gt;&lt;SPAN&gt;(&lt;/SPAN&gt;&lt;SPAN&gt;tostring&lt;/SPAN&gt;&lt;SPAN&gt;(&lt;/SPAN&gt;&lt;SPAN&gt;Results&lt;/SPAN&gt;&lt;SPAN&gt;.&lt;/SPAN&gt;&lt;SPAN&gt;TruePositives&lt;/SPAN&gt;&lt;SPAN&gt;)&amp;lt;&amp;gt;&lt;/SPAN&gt;&lt;SPAN&gt;''&lt;/SPAN&gt;&lt;SPAN&gt;,&lt;/SPAN&gt;&lt;SPAN&gt;toint&lt;/SPAN&gt;&lt;SPAN&gt;(&lt;/SPAN&gt;&lt;SPAN&gt;Results&lt;/SPAN&gt;&lt;SPAN&gt;.&lt;/SPAN&gt;&lt;SPAN&gt;TruePositives&lt;/SPAN&gt;&lt;SPAN&gt;),&lt;/SPAN&gt;&lt;SPAN&gt;toint&lt;/SPAN&gt;&lt;SPAN&gt;(&lt;/SPAN&gt;&lt;SPAN&gt;Results&lt;/SPAN&gt;&lt;SPAN&gt;.&lt;/SPAN&gt;&lt;SPAN&gt;Total&lt;/SPAN&gt;&lt;SPAN&gt;))&lt;/SPAN&gt;&lt;/DIV&gt;&lt;DIV&gt;&lt;SPAN&gt;|&amp;nbsp;&lt;/SPAN&gt;&lt;SPAN&gt;project&lt;/SPAN&gt;&lt;SPAN&gt;-&lt;/SPAN&gt;&lt;SPAN&gt;away&lt;/SPAN&gt;&lt;SPAN&gt;&amp;nbsp;&lt;/SPAN&gt;&lt;SPAN&gt;Results&lt;/SPAN&gt;&lt;/DIV&gt;&lt;/DIV&gt;</description>
      <pubDate>Fri, 21 May 2021 02:59:40 GMT</pubDate>
      <guid>https://community.fabric.microsoft.com/t5/DAX-Commands-and-Tips/Need-help-on-Dax-for-KQL-query/m-p/1855552#M39696</guid>
      <dc:creator>rajutechstar</dc:creator>
      <dc:date>2021-05-21T02:59:40Z</dc:date>
    </item>
    <item>
      <title>Re: Need help on Dax for KQL query</title>
      <link>https://community.fabric.microsoft.com/t5/DAX-Commands-and-Tips/Need-help-on-Dax-for-KQL-query/m-p/1856543#M39720</link>
      <description>&lt;P&gt;can anybody provide SQL query for above kql queries?&lt;/P&gt;</description>
      <pubDate>Fri, 21 May 2021 09:32:52 GMT</pubDate>
      <guid>https://community.fabric.microsoft.com/t5/DAX-Commands-and-Tips/Need-help-on-Dax-for-KQL-query/m-p/1856543#M39720</guid>
      <dc:creator>rajutechstar</dc:creator>
      <dc:date>2021-05-21T09:32:52Z</dc:date>
    </item>
    <item>
      <title>Re: Need help on Dax for KQL query</title>
      <link>https://community.fabric.microsoft.com/t5/DAX-Commands-and-Tips/Need-help-on-Dax-for-KQL-query/m-p/1858025#M39786</link>
      <description>&lt;P&gt;Hi&amp;nbsp;&lt;a href="javascript:void(0)" data-lia-user-mentions="" data-lia-user-uid="303303" data-lia-user-login="rajutechstar" class="lia-mention lia-mention-user"&gt;rajutechstar&lt;/a&gt;&amp;nbsp;,&lt;/P&gt;&lt;P&gt;Try this article:&amp;nbsp;&lt;A href="https://docs.microsoft.com/bs-cyrl-ba/azure/data-explorer/kusto/query/sqlcheatsheet" target="_blank"&gt;https://docs.microsoft.com/bs-cyrl-ba/azure/data-explorer/kusto/query/sqlcheatsheet&lt;/A&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&lt;FONT size="2" color="#333399"&gt;&lt;EM&gt;If this post helps, then please consider &lt;U&gt;Accept it as the solution&lt;/U&gt; &lt;span class="lia-unicode-emoji" title=":heavy_check_mark:"&gt;✔️&lt;/span&gt;to help the other members find it more quickly.&lt;/EM&gt;&lt;/FONT&gt;&lt;/P&gt;</description>
      <pubDate>Sat, 22 May 2021 10:31:32 GMT</pubDate>
      <guid>https://community.fabric.microsoft.com/t5/DAX-Commands-and-Tips/Need-help-on-Dax-for-KQL-query/m-p/1858025#M39786</guid>
      <dc:creator>ERD</dc:creator>
      <dc:date>2021-05-22T10:31:32Z</dc:date>
    </item>
  </channel>
</rss>

