Today I would like to quickly share two queries. The first query counts number of devices that sent a heartbeat last month. The second query shows the number of devices sent heartbeat per month, for the current year.
let LastMonthEndDate = (startofmonth(now()) - 1h); let LastMonthStartDate = startofmonth(LastMonthEndDate); Heartbeat | where TimeGenerated between(LastMonthStartDate .. (LastMonthEndDate)) | distinct Computer | summarize ['Devices Last Month'] = count()
let YearStartDate = (startofyear(now()) - 1h); Heartbeat | where TimeGenerated between(YearStartDate .. (now())) | extend Month = (datetime_part("month", TimeGenerated)) | summarize Devices = dcount(Computer) by Month