Hi Sentinel Community,

I am encountering an issue where the email subject line is not being captured correctly for certain records in my URL click event table. My goal is to get the URLs clicked by users along with the corresponding email subject lines. To achieve this, I applied a left outer join between the URL click event table and the email event table based on the network message ID.

However, after running the query, I notice that the subject column is empty for some records where users have clicked the URL, which was originally sent via email

the query which i used 

UrlClickEvents
| search “email address removed for privacy reasons” // user name
| join kind= leftouter EmailEvents on $left.NetworkMessageId== $right.NetworkMessageId
//| where RecipientEmailAddress==”example.com”
| join kind= leftouter EmailPostDeliveryEvents on $left.NetworkMessageId== $right.NetworkMessageId
//|where isempty( Subject) and Workload =~”email”
| project TimeGenerated,Subject,SenderFromAddress=hash_sha256(SenderFromAddress),RecipientEmailAddress=hash_sha256(RecipientEmailAddress),Url=hash_md5(Url),Workload,NetworkMessageId=hash_md5(NetworkMessageId)

​Hi Sentinel Community,I am encountering an issue where the email subject line is not being captured correctly for certain records in my URL click event table. My goal is to get the URLs clicked by users along with the corresponding email subject lines. To achieve this, I applied a left outer join between the URL click event table and the email event table based on the network message ID.However, after running the query, I notice that the subject column is empty for some records where users have clicked the URL, which was originally sent via email the query which i used  UrlClickEvents| search “email address removed for privacy reasons” // user name| join kind= leftouter EmailEvents on $left.NetworkMessageId== $right.NetworkMessageId//| where RecipientEmailAddress==”example.com”| join kind= leftouter EmailPostDeliveryEvents on $left.NetworkMessageId== $right.NetworkMessageId//|where isempty( Subject) and Workload =~”email”| project TimeGenerated,Subject,SenderFromAddress=hash_sha256(SenderFromAddress),RecipientEmailAddress=hash_sha256(RecipientEmailAddress),Url=hash_md5(Url),Workload,NetworkMessageId=hash_md5(NetworkMessageId)     Read More

​