Mar 01 2021
05:51 AM
- last edited on
Apr 08 2022
10:44 AM
by
TechCommunityAP
Mar 01 2021
05:51 AM
- last edited on
Apr 08 2022
10:44 AM
by
TechCommunityAP
HI,
My requirement is to find the status of few windows services whether its running/stopped/started.
Events will capture only the last state of the service so cannot see logs if there is no change in the current state .
For Eg:
Event
| where EventLog == 'System' and EventID == 7036 and Source == 'Service Control Manager' and RenderedDescription startswith_cs 'cisco' | parse kind=relaxed EventData with * '<Data Name="param1">' Windows_Service_Name '</Data><Data Name="param2">' Windows_Service_State '</Data>' *
| sort by TimeGenerated desc
| project Computer, Windows_Service_Name, Windows_Service_State, TimeGenerated
Above query returns the status of all the services that starts with Cisco within a time range that is selected. if there is no change of state within that time frame then it don't return those result sets.
But How to find the last status of the service in Events ?
Mar 01 2021 12:13 PM
SolutionMar 01 2021 11:41 PM
@CliveWatson Thanks for the reply.
I have modified my query to below one
Event
| where TimeGenerated < ago(3m) // last 3 months
| where Computer == '' // VM instance name
| where EventLog == 'System' and EventID == 7036 and Source == 'cisco' and RenderedDescription startswith_cs 'cisco'
| parse kind=relaxed EventData with * '<Data Name="param1">' Windows_Service_Name '</Data><Data Name="param2">' Windows_Service_State '</Data>' *
| project TimeGenerated, Computer, Windows_Service_Name, Windows_Service_State
| summarize arg_max(TimeGenerated, *) by Windows_Service_Name
| sort by TimeGenerated desc
If this query is executed without '| where TimeGenerated < ago(3m) ' it by default takes 24 hours.
So modified query to check status for last 3 months . Its working as expected in query explorer.
But when this is pinned to dashboard , it's not retuning the result as it still takes the TimeRange from the dashboard and when i cannot override to check for last 3 months .
How to display this result in dashboard ?
Mar 02 2021 12:57 AM
Make sure you "set in Query" in the Dashboard. Also 3m == 3 minutes, so you would need 90d for 3months The timespan data type - Azure Data Explorer | Microsoft Docs.
When using ago() ago() - Azure Data Explorer | Microsoft Docs
use ">" rather than "<"
Mar 02 2021 01:10 AM
@CliveWatson , Have modified my query as u suggested.
In dashboard , I don't have similar option like yours. when I click that icon it opens edit query box like the image below and there's not much option.
Mar 02 2021 03:24 AM
Mar 02 2021 03:28 AM
@CliveWatson Thanks ! I already tried this option but not useful to my scenerio.
Again here there is no option to select last 3 Months .I have to choose a time range and cannot use the query as it is which already have time range to check last 3 months data.
Mar 17 2021 03:48 AM
Mar 01 2021 12:13 PM
Solution