Forum Discussion
Resoure Graph Explorer
I’m looking to retrieve a list of Azure resources that were created within the last 24 hours. However, it appears that Azure does not consistently expose the timeCreated property across all resource types, which makes direct filtering challenging.
Request for Clarification/Support:
Could you please confirm if there’s a reliable way to filter resources based on their creation time — for example, resources created in the last N days or within the last 6 hours? If timeCreated is not uniformly available, what’s the recommended approach (e.g., using Resource Graph, Activity Logs, or any other reliable method) to achieve this?
2 Replies
The recommended approach should be Azure activity logs (Log Analytics):
AzureActivity | where OperationNameValue == "Microsoft.Resources/subscriptions/resourceGroups/resources/write" | where ActivityStatusValue == "Succeeded" | where TimeGenerated > ago(24h) | project ResourceGroup, ResourceProvider, Resource, TimeGenerated, CallerThis is something I was trying to do myself and the AzureActivity table in Log Analytics didn't surface all results either. I am using the following Resource Graph Explorer query. It does return some null results, which I've filtered out in the query. I had opened a support ticket with Microsoft and was advised not all resources have a creation timestamp.
Vinoth_Azure , see if the query below helps you. I went a step further, I'm running this query inside of Power Bi and showing this data on a dashboard. Of course the data is only updated as of the last refresh however that was fine for my needs - I just wanted to know what was created in my environment over the last x days. With Power Bi, you can add additional controls, data manipulation and logic to make this data even more powerful.Resources
| project
Name = name,
Location = location,
Type = type,
SubscriptionID = subscriptionId,
ResourceGroup = resourceGroup,
OSName = tostring(properties.extended.instanceView.osName),
ImageSKU = tostring(properties.storageProfile.imageReference.sku),
TenantID = tenantId,
Created = coalesce(
properties.timeCreated,
properties.creationTime,
properties.createdDateTime,
properties.created,
properties.createdAt
)
| where Type !in~ (
"microsoft.compute/virtualmachines/extensions",
"microsoft.network/networkinterfaces",
"microsoft.web/sites",
"microsoft.sql/servers"
)
| where isnotempty(Created) and Created > ago(1d)
| sort by Type asc
