Log Analytics | Query to pull the Patch installed Date/Time details

%3CLINGO-SUB%20id%3D%22lingo-sub-1302940%22%20slang%3D%22en-US%22%3ELog%20Analytics%20%7C%20Query%20to%20pull%20the%20Patch%20installed%20Date%2FTime%20details%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1302940%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20Guyz%2C%3C%2FP%3E%3CP%3EPatch%20InstallTimeAvailable%20(installed%20Date%2FTime)%20column%20showing%20no%20result%20while%20pulling%20the%20report%20for%20Windows%20server(s).%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%20in%20advance%20to%20provide%20the%20necessary%20query%20to%20pull%20those%20details%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22Screenshot.png%22%20style%3D%22width%3A%20684px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F183971i9450157822898583%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20title%3D%22Screenshot.png%22%20alt%3D%22Screenshot.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1302940%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%20Log%20Analytics%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1304716%22%20slang%3D%22en-US%22%3ERe%3A%20Log%20Analytics%20%7C%20Query%20to%20pull%20the%20Patch%20installed%20Date%2FTime%20details%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1304716%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F619578%22%20target%3D%22_blank%22%3E%40DINESHA%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EI%20don't%20re-call%20that%20column%20being%20used%2C%20but%20please%20check%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fautomation%2Fautomation-update-management-query-logs%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fautomation%2Fautomation-update-management-query-logs%3C%2FA%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1305620%22%20slang%3D%22en-US%22%3ERe%3A%20Log%20Analytics%20%7C%20Query%20to%20pull%20the%20Patch%20installed%20Date%2FTime%20details%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1305620%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F239477%22%20target%3D%22_blank%22%3E%40Clive%20Watson%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%20for%20the%20quick%20response%2C%20We%20had%20gone%20through%20with%20many%20website(s)%20including%20the%20one%20you%20mentioned..still%20we%20failed%20to%20get%20any%20details%20related%20to%20that.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1305869%22%20slang%3D%22en-US%22%3ERe%3A%20Log%20Analytics%20%7C%20Query%20to%20pull%20the%20Patch%20installed%20Date%2FTime%20details%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1305869%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F619578%22%20target%3D%22_blank%22%3E%40DINESHA%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CBR%20%2F%3E%3CBR%20%2F%3ECould%20you%20do%20this%20another%20way%2C%20this%20gets%20the%20last%20time%20an%20update%20was%20applied%3F%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CPRE%20class%3D%22lia-code-sample%20language-cpp%22%3E%3CCODE%3EUpdate%0A%7C%20where%20UpdateState%20%3D%3D%20%22Installed%22%0A%7C%20summarize%20arg_max(TimeGenerated%2C*)%20by%20Title%2C%20Computer%2C%20Product%2C%20ComputerEnvironment%2C%20KBID%2C%20ApprovalSource%2C%20Type%3C%2FCODE%3E%3C%2FPRE%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1306315%22%20slang%3D%22en-US%22%3ERe%3A%20Log%20Analytics%20%7C%20Query%20to%20pull%20the%20Patch%20installed%20Date%2FTime%20details%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1306315%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F239477%22%20target%3D%22_blank%22%3E%40Clive%20Watson%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThe%20query%20will%20show%20the%20last%20time%20generated%20data%20(Agent%20collected%20data)%2C%26nbsp%3B%20it%20doesn't%20show%20the%20patch%20applied%20date%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
New Contributor

Hi Guyz,

Patch InstallTimeAvailable (installed Date/Time) column showing no result while pulling the report for Windows server(s).

 

Thanks in advance to provide the necessary query to pull those details

 

Screenshot.png

4 Replies
Highlighted
Highlighted

@Clive Watson 

Thanks for the quick response, We had gone through with many website(s) including the one you mentioned..still we failed to get any details related to that.

Highlighted

@DINESHA 



Could you do this another way, this gets the last time an update was applied?

 

Update
| where UpdateState == "Installed"
| summarize arg_max(TimeGenerated,*) by Title, Computer, Product, ComputerEnvironment, KBID, ApprovalSource, Type

 

Highlighted

@Clive Watson 

 

The query will show the last time generated data (Agent collected data),  it doesn't show the patch applied date