How to get last status of the service in Event Logs without selecting TimeRange

[Racheal200]

HI,

My requirement is to find the status of few windows services whether its running/stopped/started.

Events will capture only the last state of the service so  cannot see logs if there is no change in the current state .

For Eg:

Event
| where EventLog == 'System' and EventID == 7036 and Source == 'Service Control Manager' and RenderedDescription startswith_cs 'cisco' | parse kind=relaxed EventData with * '<Data Name="param1">' Windows_Service_Name '</Data><Data Name="param2">' Windows_Service_State '</Data>' *
| sort by TimeGenerated desc
| project Computer, Windows_Service_Name, Windows_Service_State, TimeGenerated

Above query returns the status of all the services that starts with Cisco within a time range that is selected. if there is no change of state within that time frame then it don't return those result sets.

But How to find the last status of the service in Events ?

[#2 · Accepted solution]

This would return the last row of data - using arg_max()


Event
| where EventLog == 'System' and EventID == 7036
| summarize arg_max(TimeGenerated,*)

[#3]

@CliveWatson Thanks for the reply.

I have modified my query to below one 

Event
| where TimeGenerated < ago(3m) // last 3 months 
| where Computer == '' // VM instance name
| where EventLog == 'System' and EventID == 7036 and Source == 'cisco' and RenderedDescription startswith_cs 'cisco'
| parse kind=relaxed EventData with * '<Data Name="param1">' Windows_Service_Name '</Data><Data Name="param2">' Windows_Service_State '</Data>' *
| project TimeGenerated, Computer, Windows_Service_Name, Windows_Service_State
| summarize arg_max(TimeGenerated, *) by Windows_Service_Name
| sort by TimeGenerated desc

If this query is executed without '| where TimeGenerated < ago(3m) ' it by default takes 24 hours.

So modified query to check status for last 3 months . Its working as expected  in query explorer.

But when this is pinned to  dashboard , it's not retuning the result as it still takes the TimeRange from the dashboard and when i cannot override to check for last 3 months .

How to display this result in dashboard ?

[#4]

@Racheal200 

Make sure you "set in Query" in the Dashboard.  Also 3m == 3 minutes, so you would need 90d for 3months The timespan data type - Azure Data Explorer | Microsoft Docs. 

When using ago()  ago() - Azure Data Explorer | Microsoft Docs
use ">" rather than "<"

[#5]

@CliveWatson , Have modified my query as u suggested.

In dashboard , I don't have similar option like yours. when I click that icon it opens edit query box like the image below and there's not much option.

[#6]

@Racheal200 

Sorry with correct screenshot 

[#7]

@CliveWatson Thanks !  I already tried this option but not useful to my scenerio.

Again  here there is no option to select last 3 Months .I have to choose a time range and cannot use the query as it is which already have time range to check last 3 months data.

[#8]

You should have the updated solution I showed in your subscription now: https://techcommunity.microsoft.com/t5/azure-monitor/enhanced-dashboard-experiences-for-azure-monito...