CODEWITHSUNDEEP
azure-log-analyticskql
AdamC
AdamC

Reputation: 23

How to use Kusto to return a max() row from a table, while showing other columns not used in the max grouping

Given the following Log analytics KQL query :

SigninLogs 
| where ResultType == 0 
| summarize max(TimeGenerated) by UserPrincipalName

I need to display other columns from those selected rows in the SigninLogs table. I've tried different approaches with no success. Joining back to the same table again seems unfeasible as joins appear to only be available using a single column. Other approaches using in failed because the needed columns weren't available in the above source query.

Upvotes: 2

Views: 5085

Answers (1)

Yoni L.
Yoni L.

Reputation: 26005

You can use the arg_max() aggregation function: https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/arg-max-aggfunction

Upvotes: 2

Related Questions