I'm having an issue with the map rendering correct results. Is this correct?
SecurityIncident
// Get the Workspace Name(s) from a parameter
| extend stringtoSplit = split("{WorkspaceIDguid}",",")
| mvexpand stringtoSplit
| where stringtoSplit has TenantId
| extend workSpacename = trim(@"[^\w]+",tostring(split(stringtoSplit,":").[1]))
// end of get workspace name section
| extend Tactics_ = tostring(parse_json(tostring(AdditionalData.tactics)))
| summarize count()
by workSpacename, Tactics_
| order by count_ desc
The workbook use to work but now comes up with this error:
union: column named 'TableName' already exists
Click to Retry.
Some parts of the workbook are still populating with data but 90% of the work book is broken. Same issue on both the Workspace Usage Report v1.3 and Workspace Usage Report v1.4
I have updated this in mine, but would love another picker up top next to the workspace standard picker as we often have clients or recommend a separate audit workspace.
I can do a PR if you prefer, but I see you're working on 1.4.8 and may be able to toss it in :)