Forum Discussion
Log Ingestion Delay in all Data connectors
Hi, I have integrated multiple log sources in sentinel and all the log sources are ingesting logs between 7:00 pm to 2:00 am I want the log ingestion in real time. I have integrated Azure WAF, syslo...
Hello, I've not seen this before across such a range of connectors (assuming its not a blip and fixed itself) you might want to confirm in the Logs what the "lastSeen" or Last log recieved is.
KQL
union *
| extend lastSeen = datetime_diff('minute',now(), TimeGenerated)
| summarize arg_max(TimeGenerated,lastSeen) by TableName=Type
| order by lastSeen desc