Forum Discussion
AVD Session host uptime and Automate
2. This is yesterday, the first seen record and the last
Heartbeat
| where TimeGenerated between( startofday(ago(1d)) .. endofday(ago(1d)) )
| summarize min(TimeGenerated), max(TimeGenerated)
3. You'll need to look at a Automation Rule and Playbook for that, there are many templates in the Content Hub
- ArumaiFeb 02, 2024Copper Contributor
I am trying to extract last month report but it is erroring. Is the query structure for the last month is OK? Could you please look at this. Thanks in advance.
//Heartbeat
| where TimeGenerated between (startofmonth(ago(1m))) .. endofmonth(ago(1m)))
| summarize min(TimeGenerated), max(TimeGenerated)
//| summarize heartbeat_per_hour=count() by bin_at(TimeGenerated, 1h, start_time), Computer
| extend available_per_hour=iff(heartbeat_per_hour > 0, true, false)
| summarize Available_Hours=countif(available_per_hour == true) by Computer
| extend Total_Hours=round((max(TimeGenerated) - min(TimeGenerated) / 1h)
| extend Availability_Percentage=Available_Hours * 100 / Total_Hours
| project
Computer,
Total_Hours,
Available_Hours,
round(Availability_Percentage, 0)- Clive_WatsonFeb 02, 2024Bronze Contributor
The month part is solved with this:
Heartbeat | where TimeGenerated between ( startofmonth(now(),-1).. endofmonth(now(),-1) ) | summarize heartbeat_per_hour=count() by bin(TimeGenerated, 1h), Computer | extend available_per_hour=iff(heartbeat_per_hour > 0, true, false)
Please take a look at my article about time, for other examples: How to align your Analytics with time windows in Azure Sentinel using KQL (Kusto Query Language) - Microsoft Community Hub
- ArumaiFeb 02, 2024Copper ContributorThanks Clive, it worked. Thanks for your help.