I'm working on getting this kql query to work but unable to get the joins to work and it appears t