вот вариант для одной категории (замените группу ключом summarize
для остальных):
datatable(computer:string, featureUpdateStatus:string, qualityUpdateStatus:string, securityUpdateStatus:string, lastScan:datetime)
[
"c1", "not up-to-date", "up-to-date", "up-to-date", datetime(2020-07-07 14:03:50),
"c1", "not up-to-date", "up-to-date", "up-to-date", datetime(2020-07-07 15:02:59),
"c2", "not up-to-date", "up-to-date", "up-to-date", datetime(2020-07-06 11:44:40),
"c2", "not up-to-date", "up-to-date", "up-to-date", datetime(2020-07-07 16:18:01),
"c3", "up-to-date", "up-to-date", "up-to-date", datetime(2020-07-07 13:39:09),
"c3", "up-to-date", "up-to-date", "up-to-date", datetime(2020-07-07 12:26:45),
"c4", "not up-to-date", "up-to-date", "up-to-date", datetime(2020-07-07 16:18:01),
"c4", "up-to-date", "up-to-date", "up-to-date", datetime(2020-07-07 13:39:09),
]
| summarize arg_max(lastScan, *) by computer
| summarize count() by featureUpdateStatus
| render piechart