Kusto Query Assistance - Azure Sign In Logs - azure-active-directory

I'm new to this language and seems pretty straight forward however, I'm unsure how to drill down into tables to filter.
I'm trying to write a query that will show me all sign in's that aren't from within Australia
SigninLogs
| where LocationDetails !contains "AU"
This is fine, however, it sometimes returns blank results as it will show an MFA entry where the location is blank:
This is what a valid result with a location looks like in the logs:
Ultimately, what I'm trying to do is:
Get me all sign in's that are Outside of Australia and
DO NOT return anything where the geocoordinates are blank
This is the closest query I've come to but it's still not achieving the above:
SigninLogs
| where LocationDetails !contains "AU"
| where LocationDetails != isnull("geoCoordinates")
Any help would be appreciated! Thanks.

Try replacing
| where LocationDetails != isnull("geoCoordinates")
with
| where isnotnull(LocationDetails.geoCoordinates)
and if it can be the string {} and not null - which is hard to understand based on the snapshots you've attached - you can try:
| where isnotnull(LocationDetails.geoCoordinates) and LocationDetails.geoCoordinates != '{}'

Related

How to list all parameters in Postgres?

I was wondering if there's a parameter for the currently authenticated psql user?
But then I wonder a more broader question - how can I just see what all the paremeters are?
I might discover some interesting parameters if I could see a whole list of them?
I'm only seeing online how to get the value of one parameter. Not a list...
Alvaro has answered the question how to list your current parameter values.
To get the authenticated user, you can call the SQL function session_user:
SELECT session_user;
The currently effective user can be seen with
SELECT current_user;
In psql, you can see details about your current database session with
\conninfo
Nonsense. Try these two SQL statements:
set foo.bar =42;
and then:
select current_setting('foo.bar');
You’ve just set, and read an entity that the PostgreSQL doc doesn’t seem to name. You might call x.y a “user-defined session parameter”. Where is its value held? Server-side, of course.
I too would like to know how to list the names of all currently defined such entities—system-defined, like TimeZone, and user-defined.
— bryn#yugabyte.com
PostgreSQL does not have such a thing as server-side session variables, so it's not clear what you are asking about.
Some PLs (such as PL/Python, PL/Perl) have session variables (%_SHARED in PL/Perl, GD and SD in PL/Python for example), but they are internal to the PL, not part of the server proper.
psql also has variables, which you can set with \set, and you can get a list with the same command. I suppose that's not what you want though.
Maybe you refer to so-called custom GUC configuration parameters, which are sometimes abused as session variables. You can get a list of those using SHOW ALL or SELECT * FROM pg_catalog.pg_settings.
SHOW ALL below can show all parameters according to the documentation:
SHOW ALL;
This is how SHOW ALL works below:
postgres=# SHOW ALL;
name | setting | description
----------------------------+-------------+------------------------------------------------------------------------------------------
allow_in_place_tablespaces | off | Allows tablespaces directly inside pg_tblspc, for testing.
allow_system_table_mods | off | Allows modifications of the structure of system tables.
application_name | psql | Sets the application name to be reported in statistics and logs.
archive_cleanup_command | | Sets the shell command that will be executed at every restart point.
archive_command | (disabled) | Sets the shell command that will be called to archive a WAL file.
archive_mode | off | Allows archiving of WAL files using archive_command.
archive_timeout | 0 | Forces a switch to the next WAL file if a new file has not been started within N seconds.
array_nulls | on | Enable input of NULL elements in arrays.
authentication_timeout | 1min | Sets the maximum allowed time to complete client authentication.
autovacuum | on | Starts the autovacuum subprocess.
...
And, you can show one specific parameter with SHOW as shown below:
postgres=# SHOW allow_in_place_tablespaces;
allow_in_place_tablespaces
----------------------------
off
(1 row)
But, you cannot show more than one parameters with SHOW as shown below:
postgres=# SHOW allow_in_place_tablespaces, allow_system_table_mods;
ERROR: syntax error at or near ","
LINE 1: show allow_in_place_tablespaces, allow_system_table_mods;
So to show more than one parameters, use SELECT FROM pg_settings below:
postgres=# SELECT name, setting, short_desc FROM pg_settings WHERE name IN ('allow_in_place_tablespaces', 'allow_system_table_mods');
name | setting | short_desc
----------------------------+---------+------------------------------------------------------------
allow_in_place_tablespaces | off | Allows tablespaces directly inside pg_tblspc, for testing.
allow_system_table_mods | off | Allows modifications of the structure of system tables.
(2 rows)
In addition, current_setting() can show one specific parameter as shown below:
postgres=# SELECT current_setting('allow_in_place_tablespaces');
current_setting
-----------------
off
(1 row)
But, you cannot show more than one parameters with current_setting() as shown below:
postgres=# SELECT current_setting('allow_in_place_tablespaces', 'allow_system_table_mods');
ERROR: invalid input syntax for type boolean: "allow_system_table_mods"
LINE 1: ...ECT current_setting('allow_in_place_tablespaces', 'allow_sys...

Get scalar value from table in Kusto, KQL

I am trying to get the maximum of a column from a table and get the output of the data in the form of a scalar to be used in another table. I am attaching a sample code for reference here.
Covid19
| limit 10
| summarize (max(Confirmed))
This gives me an output as in the following image:
Result of Above Query
Now I want to get the value of the result as a scalar. I am new at KQL so maybe my approach as a whole can also be wrong any help will be appreciated.
You could use toscalar() as part of a let statement.
For example:
let maxConfirmed = toscalar(
Covid19
| limit 10
| summarize max(Confirmed)
);
... do something with 'maxConfirmed' ...

Watson Discovery Service Issue

Right Way - It's working
Wrong Way - Isn't working how should be
I'd like your help about an issue. I'm using wds and so I created a collection that was uploaded by several pieces of a manual. Once I did it, on the conversation service I also created, I put some descriptions on the intentions that the Discovery should uses. Now, when I try to identify these descriptions on the Discovery Service, unless I write exactly the same to test, it's not recognizing. Any suggestion about what can I use to fix it?
e.g. I uploaded a metadata txt file with the following fields:
+---------------------+------------+-------------+-----------------------+---------+------+
| Document | DocumentID | Chapter | Session | Title | Page |
+---------------------+------------+-------------+-----------------------+---------+------+
| Instructions Manual | BR_1 | Maintenance | Long Period of Disuse | Chassis | 237 |
+---------------------+------------+-------------+-----------------------+---------+------+
Now, when I search on the Discovery, I need to use the exactly word I put on the intention's description (Chassis). Otherwise the Discovery it's not getting through the way below:
metadata.Title:chas*|metadata.Chapter:chas*|metadata.Session:chas*
Any idea??
Please check the syntax if its right or wrong by matching it with discovery tool.
Sometimes we need inverted commas with backslash.

2005 SQL Reporting Services Dataset filter with OR not AND

Under Dataset Filters Tab, I want to use OR not AND but when I add a second Filter the AND appears in the And/Or column with no way to change it.
Am I missing something?
The way it works is that each row is anded with the next. To acheive an or expression you have to put it in the same like
line 1 -> =Fields!One.Value = 10 OR Fields!Two.Value | = | =True
line 2 -> =Fields!Three.Value | = | ="some other value"
There could be other ways of doing it, but I found this to be consistent and easy to understand.

Ranking of Full Text Search (SQL Server)

For the last couple hours I have been messing with all sorts of different variations of SQL Server full text search. However I am still unable to figure out how the ranking works. I have come across a couple examples that really confuse me as to how they rank higher then others. For example
I have a table with 5 cols + more that are not indexed. All are nvarchar fields.
I am running this query (Well almost.. I retyped with different names)
SET #SearchString = REPLACE(#Name, ' ', '*" OR "') --Splits words with an OR between
SET #SearchString = '"'+#SearchString+'*"'
print #SearchString;
SELECT ms.ID, ms.Lastname, ms.DateOfBirth, ms.Aka, ms.Key_TBL.RANK, ms.MiddleName, ms.Firstname
FROM View_MemberSearch as ms
INNER JOIN CONTAINSTABLE(View_MemberSearch, (ms.LastName, ms.Firstname, ms.MiddleName, ms.Aka, ms.DateOfBirth), #SearchString) AS KEY_TBL
ON ms.ID = KEY_TBL.[KEY]
WHERE KEY_TBL.RANK > 0
ORDER BY KEY_TBL.RANK DESC;
Thus if I search for 11/05/1964 JOHN JACKSON I would get "11/05/1964" OR "JOHN*" OR "JACKSON*" and these results:
ID -- First Name -- Middle Name -- Last Name -- AKA -- Date of Birth -- SQL Server RANK
----------------------------------------------------------------------------------
1 | DAVE | JOHN | MATHIS | NULL | 11/23/1965 | 192
2 | MARK | JACKSON | GREEN | NULL | 05/29/1998 | 192
3 | JOHN | NULL | JACKSON | NULL | 11/05/1964 | 176
4 | JOE | NULL | JACKSON | NULL | 10/04/1994 | 176
So finally my question. I don't see how row 1 and 2 are ranked above row 3 and why row 3 is ranked the same as row 4. Row 2 should have the highest rank by far seeing as the search string matches the First name and Last Name as well as the Date of birth.
If I change the OR to AND I don't get any results.
I've found AND and OR clauses don't apply across columns. Create an indexed view that merges the columns and you'll get better results. Look at my past questions and you'll find information that suites your scenario.
I also have found I'm better off not appending a '*'. I thought it'd turn up more matches, but it tended to return worse results (particularly for long words). As a middle ground you might only append a * to longer words.
The example case you give is definately weird.
It's not entirely equivalent, but perhaps this question I asked (How-to: Ranking Search Results) could be of assistance?
What happens if you remove the DoB criteria?
MS Full-Text search is really really a black box that's hard to understand and customize
You pretty much take it AS IS, unlike Lucene is great for customization
Thank you guys.
Frank you were correct that AND and OR do not go across columns this was something I did not notice at first.
To get the best results I had to merge all 5 columns into 1 column in a view. Then search on that single column. Doing so gave me the exact results I wanted without any extras.
My actual search string after converting it ended up being "Word1*" AND "Word2*"
Using the % sign still did not do what msdn said it should do. Meaning if I searched for the word josh and it got changed into "Josh%" when I searched then "Joshua" would not be found. Pretty dumb however with "Josh*" then joshua would be found.

Resources