Last Time Data Received
Query
// Last time a Data Connector received data
union withsource=TableName1 *
| where TimeGenerated > ago(2d)
| project TimeGenerated, TableName1, DeviceVendor,ProviderName
| summarize last_log = datetime_diff("second", now(), max(TimeGenerated)),last_event_received = max(TimeGenerated) by TableName1, DeviceVendor,ProviderName
| project ['Table Name'] = TableName1, ['Latest Record Created'] = last_log, ['Time'] = last_event_received, DeviceVendor, ProviderName
| order by Time descExplanation
This query retrieves the latest data received by a data connector. It filters the data to only include records from the past 2 days. It then calculates the time difference between the current time and the maximum time generated for each table, device vendor, and provider name. It also displays the maximum time generated for each combination. The results are ordered by the maximum time generated in descending order.
Details
Rod Trent
Released: June 1, 2021
Tables
TableName1
Keywords
DataConnectorReceivedUnionTableName1TimeGeneratedagoprojectDeviceVendorProviderNamesummarizedatetime_diffnowmaxlast_loglast_event_receivedTable NameLatest Record CreatedTimeorder by Time desc
Operators
unionwithsourcewhereagoprojectsummarizedatetime_diffnowmaxby['Table Name']['Latest Record Created']['Time']DeviceVendorProviderNameorder bydesc