Forum Discussion

Racheal200's avatar
Racheal200
Copper Contributor
Mar 01, 2021
Solved

How to get last status of the service in Event Logs without selecting TimeRange

HI,   My requirement is to find the status of few windows services whether its running/stopped/started. Events will capture only the last state of the service so  cannot see logs if there is no ch...
azure monitor
  • CliveWatson's avatar
    CliveWatson
    Mar 01, 2021
    This would return the last row of data - using arg_max()


    Event
    | where EventLog == 'System' and EventID == 7036
    | summarize arg_max(TimeGenerated,*)

CliveWatson's avatar
CliveWatson
Former Employee
Mar 01, 2021
This would return the last row of data - using arg_max()


Event
| where EventLog == 'System' and EventID == 7036
| summarize arg_max(TimeGenerated,*)

  • Racheal200's avatar
    Racheal200
    Copper Contributor
    Mar 01, 2021

    CliveWatson Thanks for the reply.

     

    I have modified my query to below one 

    Event
    | where TimeGenerated < ago(3m) // last 3 months 
    | where Computer == '' // VM instance name
    | where EventLog == 'System' and EventID == 7036 and Source == 'cisco' and RenderedDescription startswith_cs 'cisco'
    | parse kind=relaxed EventData with * '<Data Name="param1">' Windows_Service_Name '</Data><Data Name="param2">' Windows_Service_State '</Data>' *
    | project TimeGenerated, Computer, Windows_Service_Name, Windows_Service_State
    | summarize arg_max(TimeGenerated, *) by Windows_Service_Name
    | sort by TimeGenerated desc

     

    If this query is executed without '| where TimeGenerated < ago(3m) ' it by default takes 24 hours.

    So modified query to check status for last 3 months . Its working as expected  in query explorer.

     

    But when this is pinned to  dashboard , it's not retuning the result as it still takes the TimeRange from the dashboard and when i cannot override to check for last 3 months .

     

    How to display this result in dashboard ?