Forum Discussion
Log Analytics Query for computer last login/active date and time
That table doesn't contain that data, so are you looking for a JOIN to a table that does, something like
WaaSDeploymentStatus
| where UpdateCategory == "Quality" and TimeGenerated > ago(60d)
| summarize updateInfo = arg_max(ReleaseName, DeploymentStatus, DetailedStatus, DetailedStatusLevel, ExpectedInstallDate) by Computer
| join (
SecurityEvent
| where EventID == 4624 // 4624 - An account was successfully logged on
| summarize LastHeatbeat = arg_max(TimeGenerated, *) by Computer
) on Computer
| project updateInfo , LastHeatbeat
I see the attached.
Hello yashsedani
SecurityEvent is a table that could have that data, I used it as an example - that error suggests you don't have it, so you need to use another. I wasn't sure if you thought the column of data was in the WaaSDeploymentStatus table or you needed from another table, if so do you know which one?
Thanks Clive
I just need a query where i can get last login/active date and time of all the computers.
The Query which is posted in my first message gives me the list if machines those are not up-to-date but few of them are not even in Active Directory (may be Object is deleted or renamed).
If adding a column to my query is not possible, i am comfortable with running another query for last login/active date and then will merge both the reports.
You haven't listed any Tables - and there are 100s - so its kind of hard for me to guess on what you have.
For instance I have 33 tables that contain a Computer column - only a few of those may have logon info.
union withsource = TableName * | where isnotempty(Computer) | summarize count() by TableNameThis would list the last record per computer (assumes you have the Heartbeat table)
Heartbeat | summarize arg_max(TimeGenerated,*) by ComputerThe reason I didn't suggest Heartbeat is that machines in the WaaS table don't always have the agent, so this doesn't work for me, but may for you?
WaaSDeploymentStatus | where UpdateCategory == "Quality" and TimeGenerated > ago(60d) | summarize updateInfo = arg_max(ReleaseName, DeploymentStatus, DetailedStatus, DetailedStatusLevel, ExpectedInstallDate) by Computer | join ( Heartbeat | summarize LastHeatbeat = arg_max(TimeGenerated, *) by Computer ) on Computer | project updateInfo , LastHeatbeatFor instance if you say you have SigninLogs then this may work
SigninLogs | extend displayName_ = tostring(DeviceDetail.displayName) | summarize arg_max(TimeGenerated, *) by displayName_