Forum Discussion
How to get last status of the service in Event Logs without selecting TimeRange
HI,
My requirement is to find the status of few windows services whether its running/stopped/started.
Events will capture only the last state of the service so cannot see logs if there is no change in the current state .
For Eg:
Event
| where EventLog == 'System' and EventID == 7036 and Source == 'Service Control Manager' and RenderedDescription startswith_cs 'cisco' | parse kind=relaxed EventData with * '<Data Name="param1">' Windows_Service_Name '</Data><Data Name="param2">' Windows_Service_State '</Data>' *
| sort by TimeGenerated desc
| project Computer, Windows_Service_Name, Windows_Service_State, TimeGenerated
Above query returns the status of all the services that starts with Cisco within a time range that is selected. if there is no change of state within that time frame then it don't return those result sets.
But How to find the last status of the service in Events ?
- This would return the last row of data - using arg_max()
Event
| where EventLog == 'System' and EventID == 7036
| summarize arg_max(TimeGenerated,*)
7 Replies
- This would return the last row of data - using arg_max()
Event
| where EventLog == 'System' and EventID == 7036
| summarize arg_max(TimeGenerated,*)CliveWatson Thanks for the reply.
I have modified my query to below one
Event
| where TimeGenerated < ago(3m) // last 3 months
| where Computer == '' // VM instance name
| where EventLog == 'System' and EventID == 7036 and Source == 'cisco' and RenderedDescription startswith_cs 'cisco'
| parse kind=relaxed EventData with * '<Data Name="param1">' Windows_Service_Name '</Data><Data Name="param2">' Windows_Service_State '</Data>' *
| project TimeGenerated, Computer, Windows_Service_Name, Windows_Service_State
| summarize arg_max(TimeGenerated, *) by Windows_Service_Name
| sort by TimeGenerated descIf this query is executed without '| where TimeGenerated < ago(3m) ' it by default takes 24 hours.
So modified query to check status for last 3 months . Its working as expected in query explorer.
But when this is pinned to dashboard , it's not retuning the result as it still takes the TimeRange from the dashboard and when i cannot override to check for last 3 months .
How to display this result in dashboard ?
Make sure you "set in Query" in the Dashboard. Also 3m == 3 minutes, so you would need 90d for 3months The timespan data type - Azure Data Explorer | Microsoft Docs.
When using ago() ago() - Azure Data Explorer | Microsoft Docs
use ">" rather than "<"
