Query Details

Acrossworkspacefor Function

Query

union Update, workspace("contosoretail-it").Update, workspace("b459b4u5-912x-46d5-9cb1-p43069212nb4").Update
| where TimeGenerated >= ago(1h)
| where UpdateState == "Needed"
| summarize dcount(Computer) by Classification

Explanation

This query combines data from three different sources and filters it based on certain conditions. It then calculates the distinct count of computers for each classification.