I have two different searches that return the data that I would like to see in one report. However, I am having some trouble combining them. Each of these reports pulls from WMI data captured multiple times per day, so it is necessary to do some kind of dedup to keep the results actual and not cumulative. I am hoping someone can help me string them together.
Here are the two that work on their own.
OS Data of the host.
The raw WMI event looks like this
Caption=Microsoft Windows Server 2008 R2 Standard
You put me on the right track enough to cobble it out the rest of the way, thank you. What I ended up using was a variation on your bottom code. It worked, except it put two lines for every host.
(sourcetype="WMI:InstalledUpdates" OR sourcetype="WMI:Version") | eventstats dc(HotFixID) as "Number of Patches" by host | where sourcetype="WMI:Version" |rex "Caption=(?<OS>.*)"| dedup 1 host|table host, OS, Version, ServicePackMajorVersion, ServicePackMinorVersion, "Number of Patches"