Forum Discussion
Use of arg_max and arg_min together
This is one way:
let min_=Heartbeat
| where TimeGenerated > ago(30m)
| where Computer =="JBOX10"
| summarize arg_min(TimeGenerated,ComputerIP, Computer)
| extend Title_='min'
;
let max_=Heartbeat
| where TimeGenerated > ago(30m)
| where Computer =="JBOX10"
| summarize arg_max(TimeGenerated,ComputerIP, Computer)
| extend Title_='max'
;
union min_, max_
| project TimeGenerated, ComputerIP, Computer, Title_
Would it be possible to get the outputs of arg_min and arg_max in two separate rows as below ?
TimeGenerated ComputerIP1 Computer1
2023-11-16T11:12:24.3531826Z 20.29.245.93 JBOX10
2023-11-16T11:41:26.9028233Z 20.29.245.93 JBOX10
This is one way:
let min_=Heartbeat
| where TimeGenerated > ago(30m)
| where Computer =="JBOX10"
| summarize arg_min(TimeGenerated,ComputerIP, Computer)
| extend Title_='min'
;
let max_=Heartbeat
| where TimeGenerated > ago(30m)
| where Computer =="JBOX10"
| summarize arg_max(TimeGenerated,ComputerIP, Computer)
| extend Title_='max'
;
union min_, max_
| project TimeGenerated, ComputerIP, Computer, Title_
Clive_Watson
What I have observed when the ComputerIPs are different, it still prints only one row ( based on max/min).
Can we have different rows for different ComputerIP while using summarize arg_min(TimeGenerated,ComputerIP, Computer) ?
TimeGenerated ComputerIP1 Computer
2023-11-16T11:12:24.3531826Z 20.29.245.93 JBOX10
2023-11-16T11:41:26.9028233Z 1.2.3.4 JBOX15