Show only last status of a service

[Jan_F1801]

I am trying to write a query that shows me on which VM a service is not running.

The basic framework is quite easy to find on the net:

Event
| where TimeGenerated >ago(1d)
| where EventLog == "System" and EventID ==7036 and Source == "Service Control Manager"
| parse kind=relaxed EventData with * '<Data Name="param1">' Windows_Service_Name '</Data><Data Name="param2">' Windows_Service_State '</Data>'*
| where Windows_Service_Name contains "choco".
| sort by TimeGenerated desc
| project Computer, Windows_Service_Name, Windows_Service_State, TimeGenerated

But now I want to display only the last state. (As you can see in the example, the service was stopped at first, but then started again).
In this case I am only interested in the fact that the service is running again.

But I can't do this with the summarize.

 

[#2 · Accepted solution]

You can use arg_max() - simplified example:


Event
| where TimeGenerated >ago(1d)
| where EventLog == "System"
| summarize arg_max(TimeGenerated, EventID, Computer)