Forum Discussion

Jan_F1801's avatar
Jan_F1801
Copper Contributor
Nov 19, 2021
Solved

Show only last status of a service

I am trying to write a query that shows me on which VM a service is not running.

The basic framework is quite easy to find on the net:

 

Event
| where TimeGenerated >ago(1d)
| where EventLog == "System" and EventID ==7036 and Source == "Service Control Manager"
| parse kind=relaxed EventData with * '<Data Name="param1">' Windows_Service_Name '</Data><Data Name="param2">' Windows_Service_State '</Data>'*
| where Windows_Service_Name contains "choco".
| sort by TimeGenerated desc
| project Computer, Windows_Service_Name, Windows_Service_State, TimeGenerated

 

 

But now I want to display only the last state. (As you can see in the example, the service was stopped at first, but then started again).
In this case I am only interested in the fact that the service is running again.

But I can't do this with the summarize.

  • You can use arg_max() - simplified example:


    Event
    | where TimeGenerated >ago(1d)
    | where EventLog == "System"
    | summarize arg_max(TimeGenerated, EventID, Computer)

1 Reply

  • Clive_Watson's avatar
    Clive_Watson
    Bronze Contributor
    You can use arg_max() - simplified example:


    Event
    | where TimeGenerated >ago(1d)
    | where EventLog == "System"
    | summarize arg_max(TimeGenerated, EventID, Computer)

Resources