KQL Search

Query Details

HomeAI ToolsDevice Query

Tables Not Ingesting Datain3days

Query

//Check all Tables to see which ones have not ingested data in 3 days or more

union withsource=BadTable *
| where TimeGenerated > ago(30d)
| summarize Entries = count(), last_log = datetime_diff("second",now(), max(TimeGenerated)), estimate  = sumif(_BilledSize, _IsBillable==true)  by BadTable
| where last_log >= 259200
| project BadTable

Explanation

This query checks all tables to see which ones have not received any new data in the past 3 days or more. It calculates the number of entries in each table, the time difference between the current time and the latest log entry, and estimates the total size of billable data. It then filters out tables where the last log entry is greater than or equal to 259,200 seconds (3 days) and displays the table name.

Details

Rod Trent profile picture

Rod Trent

Released: October 21, 2020

Tables

BadTable

Keywords

Tables,BadTable,TimeGenerated,Entries,last_log,estimate

Operators

unionwithsource*where>agosummarizecount()last_logdatetime_diff()now()max()estimatesumif()_BilledSize_IsBillablebyBadTableproject

Actions