Merge pull request #4427 from MicrosoftDocs/batamig-patch-3

total of query results clarification

Author: batamig

unified-secops-platform/mto-advanced-hunting.md

@@ -49,6 +49,8 @@ You can run any query that you already have access to in the multitenant managem
 
    :::image type="content" source="media/mto-advanced-hunting/mto-cross-tenants-sidepane.png" alt-text="Screenshot of the Microsoft Defender XDR cross tenants advanced hunting query side pane scope" lightbox="media/mto-advanced-hunting/mto-cross-tenants-sidepane.png":::
 
+    When you select multiple tenants, the query runs independently in each tenant, and the combined results are displayed in a single table. For example, the sample query below (`DeviceEvents | take 10`) returns 10 results per tenant, resulting in a total equal to 10 multiplied by the number of tenants selected.
+      
 1. When you're done, select **Apply** > **Run query**.
 
    :::image type="content" source="media/mto-advanced-hunting/mto-cross-tenants-query-tenant-id.png" alt-text="Screenshot of the Microsoft Defender XDR ross tenants advanced hunting query scope column" lightbox="media/mto-advanced-hunting/mto-cross-tenants-query-tenant-id.png":::
@@ -68,7 +70,6 @@ You can run any query that you already have access to in the multitenant managem
    | take 10
    ```
 
-
 > [!NOTE]
 > If you have tables with the same name but different schemas in multiple workspaces and want to use them in the same query, you should use the workspace operator to uniquely identify the table that you need.