@back2root that was very helpful, I ended up using that suggestion with this full query:
computer_dns_name="*"
| streamstats current=false last(group_name) as new_group_name last(_time) as time_of_change by computer_dns_name
| where group_name!=new_group_name
| convert ctime(time_of_change) as time_of_change
| rename group_name as old_group_name
| table time_of_change, computer_dns_name, old_group_name, new_group_name
... View more