title: How to get a query for unique value in kql
body: <p>I have this query</p>
  <pre><code>// A Conditional Access Device platforms condition has changed (the Device platforms condition can be spoofed).
  CrossTenantAuditLogsProd
  | where OperationName  in (&quot;Update conditional access policy&quot;)
  | extend excludePlatformsOld=extractjson(&quot;$.conditions.platforms.excludePlatforms&quot;, tostring(TargetResources[0].modifiedProperties[0].oldValue))
  | extend excludePlatformsNew=extractjson(&quot;$.conditions.platforms.excludePlatforms&quot;, tostring(TargetResources[0].modifiedProperties[0].newValue))
  | extend InitiatedByUserOrApp = iff(
          isnull(InitiatedBy.user.userPrincipalName),
          tostring(InitiatedBy.app.displayName),
          tostring(InitiatedBy[&quot;user&quot;].userPrincipalName)
          )
  | join kind=inner AADTenantIdANDReadableName on AADTenantId
  | where excludePlatformsOld != excludePlatformsNew
  | project 
          TimeGenerated, 
          CorrelationId,
          AccountCustomEntity = InitiatedByUserOrApp ,
          HostCustomEntity = tostring(TargetResources[0].displayName),
          TenantName = ReadableName,
          OldExcludedPlatforms = excludePlatformsOld, 
          NewExcludedPlatforms = excludePlatformsNew
  </code></pre>
  <p><a href="https://i.stack.imgur.com/yWJ8t.png" rel="nofollow noreferrer">Output</a></p>
  <p>which returns this results, however i want the unique thing that has changed here, if i go from iOs, Windows, Windowsphone to also include linux i dont want &quot;NewExcludedPlatforms&quot; to be iOs, Windows, WindowspHone and Linux, i just want it to be linux, if that makes sense</p>