We get data from OMS using Direct API. We ask for data from last 1 day - " | where TimeGenerated > ago(1d)"
However, there is a problem is a computer was offline for the weekend - when it comes back online on Monday morning, it will send data from the weekend, but TimeGenerated for this data will be dates from e.g. Saturday - so we will effectively miss this data!
In the old API there was a field called TimeCollected, which has the time the data appeared in OMS, not the time when data was generated on the client.
We don't see this field in the new API - is there any way to work around this?