Allow us to filter deduped data set (* | dedup * | where ??)
Ok now with dedup we can almost achieve the "last data point by Computer" scenario, but we cannot use where after dedup as in: Type:Heartbeat | dedup Computer | where TimeGenerated < NOW-10MINUTE
Just add the ability to use "| where" to process the deduped data set.
Terry C commented
Definitely agree with Daniele. Such feature is a 'MUST HAVE' otherwise we cannot adopt Azure Log Analytics for our business.
Mickaël M. commented
I would like to use the measure command on deduplicated data.
Example: Type:CustomData_CL | dedup Organization_s | measure count(State_s) by Organization_s
We are using custom fields. After getting the last data item of a specific type and field, via dedup or max(Timegenerated), we want to filter on certain value of a specific custom field. So after getting the last data samples we need to filter for a certain value in these last data samples.