azurekql

Application version => or Like


I have to check an application version I'd like to mark as compliant if the version is => of 116.x.x.x

This i s my query

AppInventory_CL | where AppName_s in ('Microsoft Edge') or '*' in ('Microsoft Edge') | summarize arg_max(TimeGenerated, *) by ManagedDeviceID_g, AppName_s, AppPublisher_s | project ComputerName_s, AppName_s, AppVersion_s | extend Versione = iif(AppVersion_s >= '116.0.0.0','OK','KO')

But I have this error

Cannot compare values of types string and string. Try adding explicit casts

Any help?

Thanks

This i s my query

AppInventory_CL | where AppName_s in ('Microsoft Edge') or '*' in ('Microsoft Edge') | summarize arg_max(TimeGenerated, *) by ManagedDeviceID_g, AppName_s, AppPublisher_s | project ComputerName_s, AppName_s, AppVersion_s | extend Versione = iif(AppVersion_s >= '116.0.0.0','OK','KO')

But I have this error

Cannot compare values of types string and string. Try adding explicit casts


Solution

  • You can't use mathematical things on strings, and version numbers don't always instantly translate to "proper" numbers. You'll probably want to split up the version number and do some numerical checking that way.

    AppInventory_CL 
    | where AppName_s in ('Microsoft Edge') or '*' in ('Microsoft Edge') 
    | summarize arg_max(TimeGenerated, *) by ManagedDeviceID_g, AppName_s, AppPublisher_s 
    | project ComputerName_s, AppName_s, AppVersion_s 
    | extend AppVersion_s_Dyn = split(AppVersion_s, '.') //Split the version
    | extend Versione = iif(toint(AppVersion_s_Dyn[0]) >= 116 and toint(AppVersion_s_Dyn[-1]) > 0, 'OK', 'KO') //Check on the individual elements
    //| summarize count() by Versione //Generate what we want on the pie chart
    //| render piechart //Show the piechart