I am currently running a search which provides Name of host which are unregistered at a particular time and then after 1 hour run same search to fetch unregistered host
Then I manually compare 2 reports for name of host were unregistered in first report and now changed to registered in next report.
Based on the data compared for unregistered an registered host I take necessary action on unregistered host..
My question--is there a way we can compare the data for 1 hour in 1 single search??
Query currently use is - -
| input lookup R2VirtualDedktopAssignments | where Environment=PROD And Registrations tate =Unregistered
