KQL登录日志

Question

有没有办法为每个用户提取最后两个登录，然后根据具有多个状态的用户进行过滤？我在这段代码上得到了一些帮助，但我还是坚持要把这段代码降下来。

SigninLogs
| project State = tostring(LocationDetails.state), UserDisplayName
| summarize States = make_set(State) by UserDisplayName, LocationDetails_countryOrRegion
| where array_length(States) > 1

Answer 1

这取决于您是要在最后两个登录中查找多个状态，还是拥有两个登录的用户在其历史记录中有多个状态。假设是前者，这里有一个建议：

SigninLogs
// will be good to have a time filter
| summarize by State = tostring(LocationDetails.state), UserDisplayName, LocationDetails_countryOrRegion, TimeColumn
| order by UserDisplayName, TimeColumn desc
| extend row_num = row_number(0,UserDisplayName!=prev(UserDisplayNames))
| where row_num <= 1 //pick the last two sign ins
| summarize States = make_set(State) by UserDisplayName, LocationDetails_countryOrRegion
| where array_length(States) > 1