Query Details
Last Time Data Received
Query
// Last time a Data Connector received data
union withsource=TableName1 *
| where TimeGenerated > ago(2d)
| project TimeGenerated, TableName1, DeviceVendor,ProviderName
| summarize last_log = datetime_diff("second", now(), max(TimeGenerated)),last_event_received = max(TimeGenerated) by TableName1, DeviceVendor,ProviderName
| project ['Table Name'] = TableName1, ['Latest Record Created'] = last_log, ['Time'] = last_event_received, DeviceVendor, ProviderName
| order by Time desc
Explanation
This query retrieves the latest data received by a data connector. It filters the data to only include records from the past 2 days. It then calculates the time difference between the current time and the maximum time generated for each table, device vendor, and provider name. It also displays the maximum time generated for each combination. The results are ordered by the maximum time generated in descending order.
Details
Rod Trent
Released: June 1, 2021
Tables
TableName1
Keywords
Data,Connector,Received,Union,TableName1,TimeGenerated,ago,project,DeviceVendor,ProviderName,summarize,datetime_diff,now,max,last_log,last_event_received,TableName,LatestRecordCreated,Time,orderbyTimedesc
Operators
unionwithsourcewhereagoprojectsummarizedatetime_diffnowmaxby['Table Name']['Latest Record Created']['Time']DeviceVendorProviderNameorder bydesc